I’ve always been fascinated by the JA family of TLS hashes, but I find that they’re exceptionally hard to find in common tooling. And I’m not even sure of value these days, what with the Cloudflare of it all.
Do you use these? If so, how? Are they valuable?
In my work stream I do not. But my peers in bot mitigation do, so netsec engineers and SREs working with Akamai, Cloudflare, F5/Shape, and AWS. Unless your scope covers WAFs, I don’t think traditional CSOC/IR/DE teams will have much practical exposure.
JARM mentioned!
I sometimes use JA4 but our focus has mainly been more on endpoint security rather than network security recently. For the times I have used them they have been slightly useful but not enough that i’d miss them in any significant way if they disappeared today.
JA3 is more or less obsolete now that some browsers are randomizing the order they announce ciphers and extensions. Since JA3 hashes are just an MD5 sum of handshake data (including ciphers and extensions) every new TLS handshake from such a browser will generate a new, unique, JA3 hash. Not very practical.
There’s also JA4. But the JA4+ suite is patent pending, which makes it a bit more complicated to use. Most good fingerprint databases for malware and botnets also only include JA3, which means they will have to be regenerated for JA4.
There is now also a new fingerprint method called JA5. It fixes a few flaws in JA4 and looks really promising. So if you’re gonna rebuild your TLS handshake database today, then I’d recommend using JA5.
The problem with all of these (JA[345]) is that they only make sense when the malware/backdoor/implant is including their own TLS library. If a malware instead uses the operating system’s standard API calls to establish a secure socket, then it will have the exact same JAx fingerprint as all the “normal” background traffic from that computer.
Yes, all the time
In most cases no. But JA3/JA4/JA5 is golden when you find a good TLS fingerprint to pivot on. Being able to identify all TLS handshakes from a particular malware family, regardless of victim or C2 server, is a fantastic feature.
If your tooling doesn’t support at least JA3, then it’s probably time to upgrade to something better.
Thank you for this detailed response? Do you see any additional value from the specific probing done by JARM? I find it ironic that Cloudflare released a tool that is largely obviated by their own service.
For me personally (Erik from Netresec speaking) I have very little use for JARM. JA3/JA4/JA5 are valuable from an incident response perspective as pivot points. I guess JARM is more relevant to those who want to map out adversary infrastructure using active scanning or OSINT data. That’s not my cup of tea though.
© 2026 by The Independent Federated Intelligence Network Inc. Licensed under CC BY-NC-ND 4.0
