JA3 and JA4: TLS fingerprints that expose scanners and botnets

In short. JA3 is a fingerprint of the TLS “handshake” (the ClientHello) that identifies the tool opening the encrypted connection — its library, not the user. Same tool, same fingerprint: this is how you recognize that hundreds of different IPs knocking on your WAN are actually a single scanner or a single botnet rotating addresses to avoid being blocked.

What is JA3?

It is a digital fingerprint (a hash) calculated on the ClientHello, i.e., the first message a client sends when opening a TLS connection (https, or an encrypted tunnel). The method was born at Salesforce in 2017: you take certain fields from the ClientHello, arrange them in a specific order, concatenate them, and generate an MD5. The result is a 32-character hexadecimal string, always identical for the same software.

JA3 = MD5( SSLVersion,Ciphers,Extensions,EllipticCurves,ECPointFormats )
esempio -> a0e9f5d64349fb13191bc781f81f42e1

Why does a ClientHello fingerprint work?

Because the user does not choose those fields: the program’s TLS library decides them. In the ClientHello, the client declares, in the clear, how it can speak TLS: the version, the list of offered cipher suites, the extensions, the supported elliptic curves, and the formats of their points. Which elements, and above all in what order, depends on who wrote the client: a Chrome browser, curl, the TLS library of a malware, a scanner like zgrab each have their own sequence. Change the tool, change the fingerprint; keep the same tool, keep the same fingerprint.

How does it expose the same “tool” behind many IPs (botnets, scanners)?

This is the point that makes JA3 valuable in defense. The fingerprint depends on the software, not on the IP address: an attacker can rotate hundreds of IPs, change countries, switch from one proxy to another, but if they always use the same tool, the JA3 does not change. Thus, when you analyze incoming traffic, you can stop counting “how many IPs are probing me” and start counting how many distinct tools.

• A JA3 that repeats many times from few sources → a single tool hammering a service.
• The same JA3 shared by hundreds of IPs in different countries → they are not hundreds of independent actors, but a single family of scanners or a botnet distributing the work across many nodes. The address rotation, designed to evade blocklists, is exposed by the common fingerprint.

It is the same reasoning that fuels the map The Dojo under siege: the port tells you what they are looking for, the network operator (AS) tells you which network they come from, and the JA3 tells you which tool — and whether it is always the same one behind changing IPs.

Does a JA3 mean “bad”?

No: it only says “same stack”. All Chrome instances of the same version on Windows have the same JA3, so a fingerprint alone is not proof of hostility. The value lies in the context: a JA3 that probes the WinBox port 143 times on your WAN within an hour is suspicious; the same fingerprint used by a browser opening your website is not. The fingerprint groups; it is you, with what it requests and how many times, who makes the judgment.

How do I see it on my traffic?

With a sniffer: RouterOS does not calculate the JA3 by itself, but you can mirror incoming traffic (port mirror or TZSP packets from /tool sniffer) to a machine running Wireshark, tshark, or an IDS like Suricata/Zeek, which expose that field ready to use.

You can also receive and decode those TZSP packets from code using dojo.tzsp, the Dojo library that reads RouterOS’s remote sniffer (Python and PHP) and delivers the frame, ready to be passed to tshark or Suricata.

# Estrai l'impronta JA3 e il nome richiesto (SNI) da una cattura
tshark -r cattura.pcap -Y "tls.handshake.type==1" -T fields \
  -e ip.src -e tls.handshake.ja3 -e tls.handshake.extensions_server_name

⚠️ Warning: the JA3 is read only from the ClientHello of a TLS session. Clear-text traffic (unencrypted HTTP) does not have one: there, the tool is identified by the User-Agent if anything. And remember that the fingerprint is a grouping clue, not an IP: never publish third-party IPs when describing an analysis; work with fingerprints and aggregates.

Pay attention to the JA3/JA4 difference in tools: tshark and Wireshark have the native JA3 field, but not JA4 — for that you need the JA4+ plugin by FoxIO. Suricata, on the other hand, from version 7.0.3 onwards (if compiled with JA4 support, the HAVE_JA4 option in --build-info), writes both JA3 and JA4 in its eve.json logs; the same applies to Zeek with the JA4+ package.

JA3S and JA4: the variants

JA3S is the same idea applied to the ServerHello: it fingerprints the server’s response, useful for recognizing server-side software (including certain command-and-control panels). JA4 (2023) is the evolution designed for modern TLS: it handles random GREASE values and TLS 1.3 better, and is more stable and readable. JA3 remains the most widespread and supported by tools, but if you are starting from scratch today, it is worth looking at JA4 as well.

⚠️ Warning: the JA3 is not infallible. GREASE values (random bytes that modern clients insert into the ClientHello) can introduce noise, TLS 1.3 with encrypted ClientHello (ECH) reduces what is visible, and different clients can share the same fingerprint. Use it to group and investigate, never as the sole criterion for blocking.

Is there a public database of fingerprints?

First, a useful clarification: the sniffer (Wireshark, Suricata) gives you the fingerprint, not the name of the tool. Suricata, for example, writes the JA3/JA4 hash in the logs but does not label it: the name is added by a database (or a rule that recognizes that fingerprint). The step “fingerprint → name” is done by you with a search.

These databases exist, with one limitation to keep in mind: they only catalog known fingerprints (scheduled malware or registered applications). They are not a universal “fingerprint → program” directory, and the same JA3 can also belong to legitimate software. They are meant to enrich an analysis, not to serve as an automatic verdict.

• abuse.ch SSLBL — a list of JA3s linked to real malware and botnets, including the associated family. It is historical (the JA3 feed has been static since 2021, when JA3 fingerprints began to lose stability), but it remains an excellent reference for classic cases. You can download it and search it like this:

  curl -s https://sslbl.abuse.ch/blacklist/ja3_fingerprints.csv | grep -i <impronta>

• ja4db.com (FoxIO) — the JA4 database, modern and updated daily: search for a fingerprint and it will provide the associated application/library/device and the recommended detection logic. It is also downloadable (https://ja4db.com/api/download/) for local cross-referencing: it is the living counterpart to the old SSLBL JA3 feed.
• ja3er.com — the old “reverse lookup” service (fingerprint → observed user-agents): it is now defunct, so do not rely on it.

A few “famous” JA3s taken directly from the SSLBL database, to give you an idea of what it means to recognize them in your traffic — if you see this fingerprint, behind it is:

b386946a5a44d1ddcc843bc75336dfce  ->  Dridex    (trojan bancario)
1aa7bf8b97e540ca5edd75f7b8384bfa  ->  TrickBot  (trojan bancario / botnet)
35c0a31c481927f022a3b530255ac080  ->  Tofsee    (botnet da spam)
c201b92f8b483fa388be174d6689f534  ->  Gozi      (trojan bancario)
3cda52da4ade09f1f781ad2e82dcfa20  ->  QakBot    (trojan bancario / loader)
fc54e0d16d9764783542f0146a98b300  ->  AsyncRAT  (accesso remoto)

And a few real JA4s from the FoxIO database: here the fingerprint is also readable (t13d… means TLS 1.3 over TCP), and you will find legitimate software and offensive tools side by side — if you see this:

t13d1517h2_8daaf6152771_cb7bf5808d99    ->  Chrome         (browser legittimo)
t13d190900_9dc949149365_97f8aa674fd9    ->  Sliver         (framework C2 offensivo)
t13d201100_2b729b4bf6f3_9e7b989ebec8    ->  IcedID         (loader / malware)
t13d191000_9dc949149365_e7c285222651    ->  Evilginx       (proxy di phishing)
ge11cn060000_4e59edc1297a_4da5efaf0cbd  ->  Cobalt Strike  (variante JA4H, lato HTTP)

⚠️ Warning: finding one of these among the fingerprints hitting your WAN is not an automatic condemnation — dated JA3s can also match other software — but it is a strong signal: the same fingerprint, repeated and combined with suspicious ports and attempts, indicates that it is indeed that specific tool targeting you.