t12d630400_a819cc8c6927_3549fbaf615c
Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees — the same tool under different cipher options. Inferred from the family, not observed directly.
What this fingerprint encodes
t12d630400
handshake shape, human-readable
a819cc8c6927
truncated hash of the cipher list
3549fbaf615c
truncated hash of extensions + signature algorithms
- Transport
- TCP
- TLS version
- TLS 1.2
- Server name
- server name sent
- Cipher suites offered
- 63
- Extensions offered
- 4
- ALPN
- none offered
Same tool, different options
These 12 other fingerprints share this one's JA4_c — the extension and signature-algorithm hash. A client that keeps its extension set constant while varying its cipher list produces exactly this pattern, which is what a scanner iterating cipher suites looks like. A JA3 cannot show you this: its single MD5 collapses ciphers and extensions together, so every variation looks like an unrelated client.
- t12d640400_13a2a23d501b_3549fbaf615c
- t12d640400_67f0ca237a44_3549fbaf615c
- t12d640400_a3acda31d846_3549fbaf615c
- t12d640400_e31a90cd0803_3549fbaf615c
- t12d640400_e7b476f9520b_3549fbaf615c
- t12d640400_f559eb9565fd_3549fbaf615c
- t12d060400_272d6f91cd02_3549fbaf615c
- t12d630400_305e7cc661dc_3549fbaf615c
- t12d630400_4607ee80f03a_3549fbaf615c
- t12d630400_6ea97102b799_3549fbaf615c
- t12d630400_c47ce3b2bf1f_3549fbaf615c
- t12d630400_f4a33ce78bd4_3549fbaf615c
The hello it was computed from
Recovered because the proxy now stores the pre-hash JA3 string alongside the digest. Every number below came out of this client's ClientHello; anything we cannot name in the IANA registry is shown as its raw value rather than guessed at.
- Version
- TLS 1.2
Cipher suites 63
-
166 (0x00a6) -
58 (0x003a) -
109 (0x006d) -
167 (0x00a7) -
49222 (0xc046) -
49242 (0xc05a) -
49223 (0xc047) -
49243 (0xc05b) -
70 (0x0046) -
191 (0x00bf) -
49284 (0xc084) -
137 (0x0089) -
197 (0x00c5) -
49285 (0xc085) -
26 (0x001a) -
24 (0x0018) -
155 (0x009b) -
TLS_DHE_RSA_WITH_AES_128_CCM_8 -
TLS_RSA_WITH_AES_128_CCM_8 -
TLS_DHE_RSA_WITH_AES_256_CCM_8 -
TLS_RSA_WITH_AES_256_CCM_8 -
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA -
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA -
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 -
TLS_RSA_WITH_AES_128_CCM -
TLS_DHE_RSA_WITH_AES_128_CCM -
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 -
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA -
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 -
TLS_RSA_WITH_AES_256_CCM -
TLS_DHE_RSA_WITH_AES_256_CCM -
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 -
49224 (0xc048) -
49244 (0xc05c) -
49225 (0xc049) -
49245 (0xc05d) -
TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 -
49286 (0xc086) -
TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 -
49287 (0xc087) -
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 -
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft) -
49158 (0xc006) -
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA -
49204 (0xc034) -
49205 (0xc035) -
49207 (0xc037) -
53251 (0xd003) -
53253 (0xd005) -
53249 (0xd001) -
49206 (0xc036) -
49208 (0xc038) -
53250 (0xd002) -
49264 (0xc070) -
49265 (0xc071) -
49306 (0xc09a) -
49307 (0xc09b) -
52396 (0xccac) -
49209 (0xc039) -
49210 (0xc03a) -
49211 (0xc03b) -
49203 (0xc033) -
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
Extensions 4
-
supported_groups -
ec_point_formats -
server_name -
signature_algorithms
Named groups 6
-
secp256r1 -
secp384r1 -
secp521r1 -
x25519 -
ffdhe2048 -
SecP256r1MLKEM768
Point formats 1
-
uncompressed
Raw JA3 string
771,166-58-109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170,10-11-0-13,23-24-25-29-256-4588,0Seen in live traffic
- Connections
- 1
- First seen
- 2026-08-27 08:59 UTC
- Last seen
- 2026-08-27 08:59 UTC
- Transport
- TCP
This entry is an observation, not a policy decision. It is here because the edge saw it, not because anyone reviewed it, and it blocks nothing on its own. Only the curated tier drives classification and banning.