t11i640200_e31a90cd0803_c2f961105e84
Probe (legacy TLS, no SNI, no ALPN) — inferred from the JA4 handshake shape.
What this fingerprint encodes
t11i640200
handshake shape, human-readable
e31a90cd0803
truncated hash of the cipher list
c2f961105e84
truncated hash of extensions + signature algorithms
- Transport
- TCP
- TLS version
- TLS 1.1
- Server name
- no server name (IP literal)
- Cipher suites offered
- 64
- Extensions offered
- 2
- ALPN
- none offered
Same tool, different options
These 11 other fingerprints share this one's JA4_c — the extension and signature-algorithm hash. A client that keeps its extension set constant while varying its cipher list produces exactly this pattern, which is what a scanner iterating cipher suites looks like. A JA3 cannot show you this: its single MD5 collapses ciphers and extensions together, so every variation looks like an unrelated client.
- t10i640200_13a2a23d501b_c2f961105e84
- t10i640200_67f0ca237a44_c2f961105e84
- t10i640200_a3acda31d846_c2f961105e84
- t10i640200_e31a90cd0803_c2f961105e84
- t10i640200_e7b476f9520b_c2f961105e84
- t10i640200_f559eb9565fd_c2f961105e84
- t11i640200_13a2a23d501b_c2f961105e84
- t11i640200_67f0ca237a44_c2f961105e84
- t11i640200_a3acda31d846_c2f961105e84
- t11i640200_e7b476f9520b_c2f961105e84
- t11i640200_f559eb9565fd_c2f961105e84
The hello it was computed from
Recovered because the proxy now stores the pre-hash JA3 string alongside the digest. Every number below came out of this client's ClientHello; anything we cannot name in the IANA registry is shown as its raw value rather than guessed at.
- Version
- TLS 1.1
Cipher suites 64
-
109 (0x006d) -
167 (0x00a7) -
49222 (0xc046) -
49242 (0xc05a) -
49223 (0xc047) -
49243 (0xc05b) -
70 (0x0046) -
191 (0x00bf) -
49284 (0xc084) -
137 (0x0089) -
197 (0x00c5) -
49285 (0xc085) -
26 (0x001a) -
24 (0x0018) -
155 (0x009b) -
TLS_DHE_RSA_WITH_AES_128_CCM_8 -
TLS_RSA_WITH_AES_128_CCM_8 -
TLS_DHE_RSA_WITH_AES_256_CCM_8 -
TLS_RSA_WITH_AES_256_CCM_8 -
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA -
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA -
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 -
TLS_RSA_WITH_AES_128_CCM -
TLS_DHE_RSA_WITH_AES_128_CCM -
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 -
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA -
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 -
TLS_RSA_WITH_AES_256_CCM -
TLS_DHE_RSA_WITH_AES_256_CCM -
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 -
49224 (0xc048) -
49244 (0xc05c) -
49225 (0xc049) -
49245 (0xc05d) -
TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 -
49286 (0xc086) -
TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 -
49287 (0xc087) -
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 -
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft) -
49158 (0xc006) -
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA -
49204 (0xc034) -
49205 (0xc035) -
49207 (0xc037) -
53251 (0xd003) -
53253 (0xd005) -
53249 (0xd001) -
49206 (0xc036) -
49208 (0xc038) -
53250 (0xd002) -
49264 (0xc070) -
49265 (0xc071) -
49306 (0xc09a) -
49307 (0xc09b) -
52396 (0xccac) -
49209 (0xc039) -
49210 (0xc03a) -
49211 (0xc03b) -
49203 (0xc033) -
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA -
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA -
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 -
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Extensions 2
-
supported_groups -
ec_point_formats
Named groups 6
-
secp256r1 -
secp384r1 -
secp521r1 -
x25519 -
ffdhe2048 -
SecP256r1MLKEM768
Point formats 1
-
uncompressed
Raw JA3 string
770,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,10-11,23-24-25-29-256-4588,0Seen in live traffic
- Connections
- 5
- First seen
- 2026-08-27 08:43 UTC
- Last seen
- 2026-08-27 08:50 UTC
- Transport
- TCP
- JA3 hashes absorbed
- 2
The same client, 2 different JA3s
This one JA4 covers 2 distinct JA3 hashes. A JA3 hashes the cipher and extension lists in the order they arrived, so a client that shuffles them — which Chrome and its derivatives do on purpose — produces a new JA3 almost every connection and fragments into what looks like 2 unrelated clients. JA4 sorts those lists before hashing, which is why all of it lands here instead.
294e0788dee8e117a8be21b195f5db460eaa05ee342d9089e87b771465ead0ae
This entry is an observation, not a policy decision. It is here because the edge saw it, not because anyone reviewed it, and it blocks nothing on its own. Only the curated tier drives classification and banning.