t13d090800_778603501f98_44e377c1c25b
Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.
What this fingerprint encodes
t13d090800
handshake shape, human-readable
778603501f98
truncated hash of the cipher list
44e377c1c25b
truncated hash of extensions + signature algorithms
- Transport
- TCP
- TLS version
- TLS 1.3
- Server name
- server name sent
- Cipher suites offered
- 9
- Extensions offered
- 8
- ALPN
- none offered
The hello it was computed from
Recovered because the proxy now stores the pre-hash JA3 string alongside the digest. Every number below came out of this client's ClientHello; anything we cannot name in the IANA registry is shown as its raw value rather than guessed at.
- Version
- TLS 1.2
Cipher suites 9
-
TLS_AES_128_GCM_SHA256 -
TLS_AES_256_GCM_SHA384 -
TLS_CHACHA20_POLY1305_SHA256 -
TLS_AES_128_CCM_SHA256 -
TLS_AES_128_CCM_8_SHA256 -
49332 (0xc0b4) -
49333 (0xc0b5) -
198 (0x00c6) -
199 (0x00c7)
Extensions 8
-
server_name -
supported_groups -
ec_point_formats -
signature_algorithms -
signed_certificate_timestamp -
supported_versions -
psk_key_exchange_modes -
key_share
Named groups 1
-
X25519MLKEM768
Point formats 1
-
uncompressed
Raw JA3 string
771,4865-4866-4867-4868-4869-49332-49333-198-199,0-10-11-13-18-43-45-51,4587,0Seen in live traffic
- Connections
- 108
- First seen
- 2026-10-11 18:20 UTC
- Last seen
- 2026-10-31 02:52 UTC
- Transport
- TCP
- JA3 hashes absorbed
- 27
The same client, 27 different JA3s
This one JA4 covers 27 distinct JA3 hashes. A JA3 hashes the cipher and extension lists in the order they arrived, so a client that shuffles them — which Chrome and its derivatives do on purpose — produces a new JA3 almost every connection and fragments into what looks like 27 unrelated clients. JA4 sorts those lists before hashing, which is why all of it lands here instead.
0416cbd73fbfeb3634c9bd15ed60bd4a07ec6a1bd5fc69f4dec21a845fd8d83b0d8f2319f26dd189b42655eb99566ad70f9e9628c7ba8b4e423dc03844258d2a1de637c04f18175827b6477594891ed5210c26f6f268f3cfb2c3c230e828435f282419aec3cf3f129a482e0b3cf860922b0f6e95e41c762df42535f2b8d53ab84502d47cfcd3e3d0daf3493f3be3fd344a6d0f7be075cb9cc2afcd5018e0f1ad4f70c0c911571e5c6b69d27b0bf32d6551c7dbb24e27e47e62a4ee0fdd48023c- … and 15 more
This entry is an observation, not a policy decision. It is here because the edge saw it, not because anyone reviewed it, and it blocks nothing on its own. Only the curated tier drives classification and banning.