{
  "id": "ja3s_fingerprint",
  "kind": "datatype",
  "status": "draft",
  "name": "JA3S TLS server fingerprint",
  "doc": "Server-side counterpart of JA3: the MD5 hash of the TLS version, the chosen cipher suite and the extensions of a ServerHello message, written as 32 lowercase hexadecimal digits. A server answers the same client the same way, so a JA3 and JA3S pair identifies a client-server negotiation, for example malware talking to its command and control server.",
  "parent": "md5hash",
  "is_pii": false,
  "categories": [
    "internet"
  ],
  "langs": [
    "common"
  ],
  "classification": "identifier",
  "regexp": "^[0-9a-f]{32}$",
  "examples": [
    {
      "value": "623de93db17d313345d7ea481e7443cf",
      "description": "Trickbot command and control server response (JA3 README)",
      "valid": true
    },
    {
      "value": "80b3a14bccc8598a1f3bbe83e71f735f",
      "description": "Emotet command and control server response (JA3 README)",
      "valid": true
    },
    {
      "value": "623de93db17d313345d7ea481e7443c",
      "description": "One hex digit short",
      "valid": false
    }
  ],
  "links": [
    {
      "type": "doc",
      "url": "https://github.com/salesforce/ja3"
    }
  ],
  "quality": {
    "score": 75,
    "missing": [
      "mapping (Wikidata, Schema.org, ...)",
      "translation",
      "detector coverage"
    ]
  },
  "source": {
    "path": "data/datatypes/any/internet/ja3s_fingerprint.yaml",
    "url": "https://github.com/apicrafter/metacrafter-registry/blob/main/data/datatypes/any/internet/ja3s_fingerprint.yaml",
    "edit_url": "https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/internet/ja3s_fingerprint.yaml"
  },
  "urls": {
    "html": "http://registry.apicrafter.io/datatype/ja3s_fingerprint",
    "json": "http://registry.apicrafter.io/api/v1/datatypes/ja3s_fingerprint.json"
  }
}