t13d090800_778603501f98_5967f2ab9927
Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.
What this fingerprint encodes
t13d090800
handshake shape, human-readable
778603501f98
truncated hash of the cipher list
5967f2ab9927
truncated hash of extensions + signature algorithms
- Transport
- TCP
- TLS version
- TLS 1.3
- Server name
- server name sent
- Cipher suites offered
- 9
- Extensions offered
- 8
- ALPN
- none offered
The hello it was computed from
Recovered because the proxy now stores the pre-hash JA3 string alongside the digest. Every number below came out of this client's ClientHello; anything we cannot name in the IANA registry is shown as its raw value rather than guessed at.
- Version
- TLS 1.2
Cipher suites 9
-
TLS_AES_128_GCM_SHA256 -
TLS_AES_256_GCM_SHA384 -
TLS_CHACHA20_POLY1305_SHA256 -
TLS_AES_128_CCM_SHA256 -
TLS_AES_128_CCM_8_SHA256 -
49332 (0xc0b4) -
49333 (0xc0b5) -
198 (0x00c6) -
199 (0x00c7)
Extensions 8
-
server_name -
supported_groups -
ec_point_formats -
signature_algorithms -
signed_certificate_timestamp -
supported_versions -
psk_key_exchange_modes -
key_share
Named groups 1
-
32 (0x0020)
Point formats 1
-
uncompressed
Raw JA3 string
771,4865-4866-4867-4868-4869-49332-49333-198-199,0-10-11-13-18-43-45-51,32,0Seen in live traffic
- Connections
- 81
- First seen
- 2026-10-11 18:20 UTC
- Last seen
- 2026-10-11 18:24 UTC
- Transport
- TCP
- JA3 hashes absorbed
- 27
The same client, 27 different JA3s
This one JA4 covers 27 distinct JA3 hashes. A JA3 hashes the cipher and extension lists in the order they arrived, so a client that shuffles them — which Chrome and its derivatives do on purpose — produces a new JA3 almost every connection and fragments into what looks like 27 unrelated clients. JA4 sorts those lists before hashing, which is why all of it lands here instead.
8a87f6c85a1468a5e3bbad5fd5dcc5511de637c04f18175827b6477594891ed551c7dbb24e27e47e62a4ee0fdd48023cdc69b1cbe4398b76bc9e4b0ef1052ee2a81ce9ebde77b258bc23abae8b4294ae7688c204cc19d94598f618fc91e1ff1f4a6d0f7be075cb9cc2afcd5018e0f1ad210c26f6f268f3cfb2c3c230e828435f0d8f2319f26dd189b42655eb99566ad7996c6f9bbe5cb8647d3440e9bc7f28ac0416cbd73fbfeb3634c9bd15ed60bd4a4f70c0c911571e5c6b69d27b0bf32d65- … and 15 more
This entry is an observation, not a policy decision. It is here because the edge saw it, not because anyone reviewed it, and it blocks nothing on its own. Only the curated tier drives classification and banning.