JA4
A next-generation TLS fingerprinting scheme proposed by FoxIO in 2023. It generates fingerprints by computing structured hashes over fields within TLS ClientHello handshake messages, enabling identification of client TLS implementation characteristics. It has been integrated into security tools including Suricata and Zeek.
Timeline (last 90 days)
The team uses TLS/HTTP signatures such as JA4 to profile traffic and determine whether requests come from real browsers or automated scripts.
Compared with User-Agent, the JA4 signature sits at the transport layer and is harder for attackers to forge at will.
JA4 extracts features such as the cipher suites, extension list, elliptic curves and signature algorithms supported by the client during the TLS handshake, and generates a short identifier after standardized sorting and hashing.
JA4 is a modern method of TLS client fingerprinting, proposed by FoxIO, and is an improvement on the earlier JA3 fingerprint.
Modern WAFs (such as Cloudflare, Akamai, AWS WAF) evaluate not only the IP but also TLS fingerprints (JA3/JA4), HTTP/2 frame order, header field order and consistency, cookie behavior, and frontend signals.
JA4 has been widely integrated into security tools such as Suricata and Zeek for identifying malware communication patterns.
JA4 is a next-generation TLS fingerprinting scheme proposed by FoxIO in 2023 to replace the previously widely used JA3.
NetWatch provides real-time decoding, display filters, flow tracking, JA4 fingerprinting, and PCAP export at the packet level.
Crawlers can be identified through behavioral analysis, request fingerprinting (TLS fingerprints JA3/JA4, HTTP header ordering), and honeypot traps.
All Facts (11)
Cloudflare通过TLS指纹（JA3/JA4）、HTTP/2帧顺序、浏览器JavaScript API、Canvas/WebGL渲染指纹等多维度指纹识别来区分真人与机器人
85%UnverifiedJA4 is an evolved version of JA3 released by FoxIO in 2023, adopting finer-grained feature extraction and a more flexible hash structure.
60%UnverifiedCompared with User-Agent, the JA4 signature sits at the transport layer and is harder for attackers to forge at will.
50%UnverifiedThe team uses TLS/HTTP signatures such as JA4 to profile traffic and determine whether requests come from real browsers or automated scripts.
50%UnverifiedJA4 is a modern method of TLS client fingerprinting, proposed by FoxIO, and is an improvement on the earlier JA3 fingerprint.
50%UnverifiedJA4 extracts features such as the cipher suites, extension list, elliptic curves and signature algorithms supported by the client during the TLS handshake, and generates a short identifier after standardized sorting and hashing.
50%UnverifiedModern WAFs (such as Cloudflare, Akamai, AWS WAF) evaluate not only the IP but also TLS fingerprints (JA3/JA4), HTTP/2 frame order, header field order and consistency, cookie behavior, and frontend signals.
50%UnverifiedNetWatch provides real-time decoding, display filters, flow tracking, JA4 fingerprinting, and PCAP export at the packet level.
50%UnverifiedJA4 is a next-generation TLS fingerprinting scheme proposed by FoxIO in 2023 to replace the previously widely used JA3.
50%UnverifiedJA4 has been widely integrated into security tools such as Suricata and Zeek for identifying malware communication patterns.
50%UnverifiedCrawlers can be identified through behavioral analysis, request fingerprinting (TLS fingerprints JA3/JA4, HTTP header ordering), and honeypot traps.
50%