JA3S TLS server fingerprint
ID ja3s_fingerprint
DatatypeNot PIIidentifierDraft
This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).
Server-side counterpart of JA3: the MD5 hash of the TLS version, the chosen cipher suite and the extensions of a ServerHello message, written as 32 lowercase hexadecimal digits. A server answers the same client the same way, so a JA3 and JA3S pair identifies a client-server negotiation, for example malware talking to its command and control server.
- Parent datatype
- MD5 hash
md5hash - Categories
- Internet
- Countries
- Global (not tied to a country)
- Languages
- Common to most languages
- Quality
- 75/100 · missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage
- Metacrafter rules
- no detection rule yet
- Supported by tools
- no tool record lists this type yet
Regular expression
^[0-9a-f]{32}$Python re syntax.
Examples
| Value | Description |
|---|---|
| 623de93db17d313345d7ea481e7443cf | Trickbot command and control server response (JA3 README) |
| 80b3a14bccc8598a1f3bbe83e71f735f | Emotet command and control server response (JA3 README) |
| 623de93db17d313345d7ea481e7443c invalid | One hex digit short |
Sources
Use this record
- Page URL:
http://registry.apicrafter.io/datatype/ja3s_fingerprint - JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
- Improve it: edit
data/datatypes/any/internet/ja3s_fingerprint.yamlon GitHub