t00d990100_523035705075_000000000000
Shares its JA4_c (000000000000) with 5 fingerprints classified as scanner, and nothing else in that family disagrees — the same tool under different cipher options. Inferred from the family, not observed directly.
What this fingerprint encodes
t00d990100
handshake shape, human-readable
523035705075
truncated hash of the cipher list
000000000000
truncated hash of extensions + signature algorithms
- Transport
- TCP
- TLS version
- unknown (00)
- Server name
- server name sent
- Cipher suites offered
- 99
- Extensions offered
- 1
- ALPN
- none offered
Same tool, different options
These 8 other fingerprints share this one's JA4_c — the extension and signature-algorithm hash. A client that keeps its extension set constant while varying its cipher list produces exactly this pattern, which is what a scanner iterating cipher suites looks like. A JA3 cannot show you this: its single MD5 collapses ciphers and extensions together, so every variation looks like an unrelated client.
- t00d170100_bee8bfcd7714_000000000000
- t00d620100_89149463b124_000000000000
- t00d990100_896f75462ccc_000000000000
- t10d070100_c50f5591e341_000000000000
- t11d070100_c50f5591e341_000000000000
- t12i060000_be96723b04dc_000000000000
- t12i100100_61a7ad8aa9b6_000000000000
- t12i990000_43812149fb09_000000000000
The hello it was computed from
Recovered because the proxy now stores the pre-hash JA3 string alongside the digest. Every number below came out of this client's ClientHello; anything we cannot name in the IANA registry is shown as its raw value rather than guessed at.
- Version
- TLS 1.0
Cipher suites 154
-
1 (0x0001) -
2 (0x0002) -
3 (0x0003) -
TLS_RSA_WITH_RC4_128_MD5 -
TLS_RSA_WITH_RC4_128_SHA -
6 (0x0006) -
7 (0x0007) -
8 (0x0008) -
9 (0x0009) -
TLS_RSA_WITH_3DES_EDE_CBC_SHA -
14 (0x000e) -
15 (0x000f) -
16 (0x0010) -
20 (0x0014) -
21 (0x0015) -
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA -
TLS_RSA_WITH_AES_128_CBC_SHA -
49 (0x0031) -
TLS_DHE_RSA_WITH_AES_128_CBC_SHA -
TLS_RSA_WITH_AES_256_CBC_SHA -
55 (0x0037) -
TLS_DHE_RSA_WITH_AES_256_CBC_SHA -
59 (0x003b) -
TLS_RSA_WITH_AES_128_CBC_SHA256 -
TLS_RSA_WITH_AES_256_CBC_SHA256 -
63 (0x003f) -
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA -
67 (0x0043) -
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA -
96 (0x0060) -
97 (0x0061) -
98 (0x0062) -
100 (0x0064) -
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 -
105 (0x0069) -
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 -
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA -
134 (0x0086) -
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA -
TLS_RSA_WITH_SEED_CBC_SHA -
152 (0x0098) -
TLS_DHE_RSA_WITH_SEED_CBC_SHA -
TLS_RSA_WITH_AES_128_GCM_SHA256 -
TLS_RSA_WITH_AES_256_GCM_SHA384 -
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 -
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 -
160 (0x00a0) -
161 (0x00a1) -
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 -
188 (0x00bc) -
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 -
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 -
194 (0x00c2) -
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 -
5815 (0x16b7) -
5817 (0x16b9) -
49163 (0xc00b) -
49164 (0xc00c) -
49165 (0xc00d) -
49166 (0xc00e) -
49167 (0xc00f) -
49168 (0xc010) -
TLS_ECDHE_RSA_WITH_RC4_128_SHA -
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA -
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA -
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA -
49179 (0xc01b) -
49182 (0xc01e) -
49185 (0xc021) -
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 -
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 -
49193 (0xc029) -
49194 (0xc02a) -
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 -
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 -
49201 (0xc031) -
49202 (0xc032) -
49212 (0xc03c) -
49213 (0xc03d) -
49216 (0xc040) -
49217 (0xc041) -
49220 (0xc044) -
49221 (0xc045) -
49228 (0xc04c) -
49229 (0xc04d) -
49230 (0xc04e) -
49231 (0xc04f) -
49232 (0xc050) -
49233 (0xc051) -
49234 (0xc052) -
49235 (0xc053) -
49236 (0xc054) -
49237 (0xc055) -
TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 -
TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 -
49250 (0xc062) -
49251 (0xc063) -
TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 -
TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 -
49272 (0xc078) -
49273 (0xc079) -
49274 (0xc07a) -
49275 (0xc07b) -
49276 (0xc07c) -
49277 (0xc07d) -
49278 (0xc07e) -
49279 (0xc07f) -
49290 (0xc08a) -
49291 (0xc08b) -
49292 (0xc08c) -
49293 (0xc08d) -
TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 -
TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 -
TLS_RSA_WITH_ARIA_128_GCM_SHA256 -
TLS_RSA_WITH_ARIA_256_GCM_SHA384 -
TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 -
TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 -
TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 -
TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 -
49411 (0xc103) -
49412 (0xc104) -
49413 (0xc105) -
49414 (0xc106) -
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft) -
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft) -
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 -
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 -
TLS_AES_128_GCM_SHA256 -
TLS_AES_256_GCM_SHA384 -
TLS_CHACHA20_POLY1305_SHA256 -
TLS_AES_128_CCM_SHA256 -
TLS_AES_128_CCM_8_SHA256 -
58384 (0xe410) -
58385 (0xe411) -
58386 (0xe412) -
58387 (0xe413) -
58398 (0xe41e) -
58399 (0xe41f) -
65278 (0xfefe) -
65279 (0xfeff) -
65408 (0xff80) -
65409 (0xff81) -
65410 (0xff82) -
65411 (0xff83) -
65504 (0xffe0) -
65505 (0xffe1) -
198 (0x00c6) -
199 (0x00c7) -
57369 (0xe019) -
57370 (0xe01a) -
57372 (0xe01c) -
57433 (0xe059) -
57434 (0xe05a) -
TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Extensions 1
-
server_name
Raw JA3 string
769,1-2-3-4-5-6-7-8-9-10-14-15-16-20-21-22-47-49-51-53-55-57-59-60-61-63-65-67-69-96-97-98-100-103-105-107-132-134-136-150-152-154-156-157-158-159-160-161-186-188-190-192-194-196-5815-5817-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49179-49182-49185-49191-49192-49193-49194-49199-49200-49201-49202-49212-49213-49216-49217-49220-49221-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49248-49249-49250-49251-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49290-49291-49292-49293-49308-49309-49310-49311-49312-49313-49314-49315-49411-49412-49413-49414-52243-52245-52392-52394-4865-4866-4867-4868-4869-58384-58385-58386-58387-58398-58399-65278-65279-65408-65409-65410-65411-65504-65505-198-199-57369-57370-57372-57433-57434-255,0,,Seen in live traffic
- Connections
- 1
- First seen
- 2026-10-20 22:31 UTC
- Last seen
- 2026-10-20 22:31 UTC
- Transport
- TCP
This entry is an observation, not a policy decision. It is here because the edge saw it, not because anyone reviewed it, and it blocks nothing on its own. Only the curated tier drives classification and banning.