JA4 t13d700700_1d99d8a1b728_9856f0503da6

t13d700700_1d99d8a1b728_9856f0503da6

Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.

What this fingerprint encodes

Transport

TCP

TLS version

TLS 1.3

Server name

server name sent

Cipher suites offered

70

Extensions offered

7

ALPN

none offered

The hello it was computed from

Recovered because the proxy now stores the pre-hash JA3 string alongside the digest. Every number below came out of this client's ClientHello; anything we cannot name in the IANA registry is shown as its raw value rather than guessed at.

Version

TLS 1.2

Cipher suites 70

• TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_WITH_RC4_128_SHA
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_RSA_WITH_AES_128_CCM
• TLS_RSA_WITH_AES_256_CCM
• 49204 (0xc034)
• 49205 (0xc035)
• TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
• 49206 (0xc036)
• 49208 (0xc038)
• 49203 (0xc033)
• TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
• 49173 (0xc015)
• 49207 (0xc037)
• 49224 (0xc048)
• 49225 (0xc049)
• 49228 (0xc04c)
• 49229 (0xc04d)
• 49244 (0xc05c)
• 49245 (0xc05d)
• TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
• TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
• 49264 (0xc070)
• 49265 (0xc071)
• TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
• TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
• TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
• 49286 (0xc086)
• 49287 (0xc087)
• 49290 (0xc08a)
• 49291 (0xc08b)
• 49306 (0xc09a)
• 49307 (0xc09b)
• 49158 (0xc006)
• 49168 (0xc010)
• 49209 (0xc039)
• 49210 (0xc03a)
• 49211 (0xc03b)
• 87 (0x0057)
• 88 (0x0058)
• 89 (0x0059)
• 90 (0x005a)
• 49174 (0xc016)
• 49175 (0xc017)
• 49176 (0xc018)
• 49177 (0xc019)
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_RSA_WITH_AES_128_CCM_8
• TLS_RSA_WITH_AES_256_CCM_8
• TLS_DHE_RSA_WITH_AES_128_CCM_8
• TLS_DHE_RSA_WITH_AES_256_CCM_8
• TLS_DHE_RSA_WITH_AES_128_CCM
• TLS_DHE_RSA_WITH_AES_256_CCM
• 52396 (0xccac)
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)
• 52248 (0xcc18)

Extensions 7

• ec_point_formats
• server_name
• signature_algorithms
• supported_versions
• key_share
• renegotiation_info
• supported_groups

Named groups 49

• 60909 (0xeded)
• 15 (0x000f)
• 16 (0x0010)
• 17 (0x0011)
• 18 (0x0012)
• 19 (0x0013)
• 20 (0x0014)
• 21 (0x0015)
• 22 (0x0016)
• secp256r1
• secp384r1
• secp521r1
• 1 (0x0001)
• 2 (0x0002)
• 3 (0x0003)
• 4 (0x0004)
• 5 (0x0005)
• 6 (0x0006)
• 7 (0x0007)
• 8 (0x0008)
• 9 (0x0009)
• 10 (0x000a)
• 11 (0x000b)
• 12 (0x000c)
• 13 (0x000d)
• 14 (0x000e)
• x25519
• x448
• 41 (0x0029)
• 26 (0x001a)
• 27 (0x001b)
• 28 (0x001c)
• 31 (0x001f)
• 32 (0x0020)
• 33 (0x0021)
• ffdhe2048
• ffdhe3072
• ffdhe4096
• 259 (0x0103)
• 260 (0x0104)
• SecP384r1MLKEM1024
• 513 (0x0201)
• 514 (0x0202)
• 4585 (0x11e9)
• 4586 (0x11ea)
• X25519MLKEM768
• SecP256r1MLKEM768
• 4589 (0x11ed)
• 4590 (0x11ee)

Point formats 1

• uncompressed

771,49160-49161-49162-49170-49171-49172-49191-49188-49192-49169-49199-49200-49195-49196-49324-49325-49204-49205-49187-49206-49208-49203-49159-49173-49207-49224-49225-49228-49229-49244-49245-49248-49249-49264-49265-49266-49267-49270-49271-49286-49287-49290-49291-49306-49307-49158-49168-49209-49210-49211-87-88-89-90-49174-49175-49176-49177-52393-52392-49328-49329-49330-49331-49326-49327-52396-52243-52244-52248,11-0-13-43-51-65281-10,60909-15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,0

Seen in live traffic

Connections

1

First seen

2026-09-23 11:05 UTC

Last seen

2026-09-23 11:05 UTC

Transport

TCP

This entry is an observation, not a policy decision. It is here because the edge saw it, not because anyone reviewed it, and it blocks nothing on its own. Only the curated tier drives classification and banning.