JA4 q13d0313h3_55b375c5d22e_6ca3580cd977

q13d0313h3_55b375c5d22e_6ca3580cd977

Chrome — inferred from the User-Agent on its requests.

What this fingerprint encodes

Transport

QUIC

TLS version

TLS 1.3

Server name

server name sent

Cipher suites offered

3

Extensions offered

13

ALPN

h3

The hello it was computed from

Recovered because the proxy now stores the pre-hash JA3 string alongside the digest. Every number below came out of this client's ClientHello; anything we cannot name in the IANA registry is shown as its raw value rather than guessed at.

Version

TLS 1.2

Cipher suites 3

• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256

Extensions 13

• encrypted_client_hello
• server_name
• 51764 (0xca34)
• key_share
• supported_groups
• application_layer_protocol_negotiation
• supported_versions
• 17613 (0x44cd)
• quic_transport_parameters
• signature_algorithms
• compress_certificate
• psk_key_exchange_modes
• pre_shared_key

Named groups 4

• SecP256r1MLKEM768
• x25519
• secp256r1
• secp384r1

771,4865-4866-4867,65037-0-51764-51-10-16-43-17613-57-13-27-45-41,4588-29-23-24,

Seen in live traffic

Connections

1328

First seen

2026-09-03 16:58 UTC

Last seen

2026-10-10 01:39 UTC

Transport

QUIC

JA3 hashes absorbed

1328

The same client, 1328 different JA3s

This one JA4 covers 1328 distinct JA3 hashes. A JA3 hashes the cipher and extension lists in the order they arrived, so a client that shuffles them — which Chrome and its derivatives do on purpose — produces a new JA3 almost every connection and fragments into what looks like 1328 unrelated clients. JA4 sorts those lists before hashing, which is why all of it lands here instead.

• f48aad1b7d4881636b4dd356c4872349
• d58aa42873e230c761f58ebb38d87b3c
• 6d19ec8f5862a14cf2c85860d35681bd
• b49d98c98a0f0dceb6affe93914cec6c
• 69e0bcb83d540924f3eaa1567284973e
• 48787aef54bec2e6ae96d64234ed13fc
• 7ea056d21cf16a8d548659a3c60a25a9
• c05984012834628b2e7cb5bfce26bb16
• 3eb2362410e79207c4763e363f67d03a
• c195ba968610b5a6027991f1594c2f21
• d08d198561ba1eee8b9b531fb8b9b4d5
• a54bc27a1e8daceb0afc8fb6e605bf64
• … and 1316 more

User-Agents seen on this fingerprint

• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 11245×
• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 2797×
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 2196×
• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 1511×
• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 1417×
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 1258×
• Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 484×
• Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 300×
• Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 294×
• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 281×
• Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 98×
• Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 51×
• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 3×
• Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 1×
• Mozilla/5.0 (compatible; ev-crawler/1.0; +https://headline.com/web-crawler) 1×

A User-Agent is self-declared and trivially forged, so this names an observation rather than proving an identity. It is still the strongest signal available: the fingerprint comes off the TLS handshake and the User-Agent off the request that followed, and one client build keeping a stable JA4 while changing what it calls itself is a finding in its own right.

This entry is an observation, not a policy decision. It is here because the edge saw it, not because anyone reviewed it, and it blocks nothing on its own. Only the curated tier drives classification and banning.