t10d640300_e31a90cd0803_6bf8f498b543
nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)
What this fingerprint encodes
t10d640300
handshake shape, human-readable
e31a90cd0803
truncated hash of the cipher list
6bf8f498b543
truncated hash of extensions + signature algorithms
- Transport
- TCP
- TLS version
- TLS 1.0
- Server name
- server name sent
- Cipher suites offered
- 64
- Extensions offered
- 3
- ALPN
- none offered
Same tool, different options
These 21 other fingerprints share this one's JA4_c — the extension and signature-algorithm hash. A client that keeps its extension set constant while varying its cipher list produces exactly this pattern, which is what a scanner iterating cipher suites looks like. A JA3 cannot show you this: its single MD5 collapses ciphers and extensions together, so every variation looks like an unrelated client.
- t10d640300_13a2a23d501b_6bf8f498b543
- t10d640300_67f0ca237a44_6bf8f498b543
- t10d640300_a3acda31d846_6bf8f498b543
- t10d640300_e7b476f9520b_6bf8f498b543
- t10d640300_f559eb9565fd_6bf8f498b543
- t11d640300_13a2a23d501b_6bf8f498b543
- t11d640300_67f0ca237a44_6bf8f498b543
- t11d640300_a3acda31d846_6bf8f498b543
- t11d640300_e31a90cd0803_6bf8f498b543
- t11d640300_e7b476f9520b_6bf8f498b543
- t11d640300_f559eb9565fd_6bf8f498b543
- t10d040300_058957366436_6bf8f498b543
- t10d130300_48b83dc3bfb9_6bf8f498b543
- t10d420300_4a5d165148b5_6bf8f498b543
- t10d640300_1715b94e3896_6bf8f498b543
- t10d640300_1e98fdfb27e9_6bf8f498b543
- t11d040300_058957366436_6bf8f498b543
- t11d130300_48b83dc3bfb9_6bf8f498b543
- t11d420300_4a5d165148b5_6bf8f498b543
- t11d640300_1715b94e3896_6bf8f498b543
- t11d640300_1e98fdfb27e9_6bf8f498b543
The hello it was computed from
Recovered because the proxy now stores the pre-hash JA3 string alongside the digest. Every number below came out of this client's ClientHello; anything we cannot name in the IANA registry is shown as its raw value rather than guessed at.
- Version
- TLS 1.0
Cipher suites 64
-
109 (0x006d) -
167 (0x00a7) -
49222 (0xc046) -
49242 (0xc05a) -
49223 (0xc047) -
49243 (0xc05b) -
70 (0x0046) -
191 (0x00bf) -
49284 (0xc084) -
137 (0x0089) -
197 (0x00c5) -
49285 (0xc085) -
26 (0x001a) -
24 (0x0018) -
155 (0x009b) -
TLS_DHE_RSA_WITH_AES_128_CCM_8 -
TLS_RSA_WITH_AES_128_CCM_8 -
TLS_DHE_RSA_WITH_AES_256_CCM_8 -
TLS_RSA_WITH_AES_256_CCM_8 -
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA -
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA -
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 -
TLS_RSA_WITH_AES_128_CCM -
TLS_DHE_RSA_WITH_AES_128_CCM -
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 -
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA -
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 -
TLS_RSA_WITH_AES_256_CCM -
TLS_DHE_RSA_WITH_AES_256_CCM -
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 -
49224 (0xc048) -
49244 (0xc05c) -
49225 (0xc049) -
49245 (0xc05d) -
TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 -
49286 (0xc086) -
TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 -
49287 (0xc087) -
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 -
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft) -
49158 (0xc006) -
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA -
49204 (0xc034) -
49205 (0xc035) -
49207 (0xc037) -
53251 (0xd003) -
53253 (0xd005) -
53249 (0xd001) -
49206 (0xc036) -
49208 (0xc038) -
53250 (0xd002) -
49264 (0xc070) -
49265 (0xc071) -
49306 (0xc09a) -
49307 (0xc09b) -
52396 (0xccac) -
49209 (0xc039) -
49210 (0xc03a) -
49211 (0xc03b) -
49203 (0xc033) -
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA -
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA -
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 -
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Extensions 3
-
supported_groups -
server_name -
ec_point_formats
Named groups 6
-
secp256r1 -
secp384r1 -
secp521r1 -
x25519 -
ffdhe2048 -
SecP256r1MLKEM768
Point formats 1
-
uncompressed
Raw JA3 string
769,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,10-0-11,23-24-25-29-256-4588,0Seen in live traffic
- Connections
- 16
- First seen
- 2026-09-06 15:53 UTC
- Last seen
- 2026-10-03 09:38 UTC
- Transport
- TCP
- JA3 hashes absorbed
- 5
The same client, 5 different JA3s
This one JA4 covers 5 distinct JA3 hashes. A JA3 hashes the cipher and extension lists in the order they arrived, so a client that shuffles them — which Chrome and its derivatives do on purpose — produces a new JA3 almost every connection and fragments into what looks like 5 unrelated clients. JA4 sorts those lists before hashing, which is why all of it lands here instead.
fa2ce5a3078abb9c449e8fbb1fe0ea6f24a712a9ef23f5d514e47fffb5596245deb61e94362e500c8eefe17a507235dc12b636358ea66419c16709def10d17c4b6e9cbc3dd73884ce74e3851203f09a5