t12d190600_9c2f387b437f_82b0993b6ad8
nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)
What this fingerprint encodes
JA4_a
t12d190600
handshake shape, human-readable
JA4_b
9c2f387b437f
truncated hash of the cipher list
JA4_c
82b0993b6ad8
truncated hash of extensions + signature algorithms
- Transport
- TCP
- TLS version
- TLS 1.2
- Server name
- server name sent
- Cipher suites offered
- 19
- Extensions offered
- 6
- ALPN
- none offered
Same tool, different options
These 1 other fingerprints share this one's JA4_c — the extension and signature-algorithm hash. A client that keeps its extension set constant while varying its cipher list produces exactly this pattern, which is what a scanner iterating cipher suites looks like. A JA3 cannot show you this: its single MD5 collapses ciphers and extensions together, so every variation looks like an unrelated client.