JA4+ Network Fingerprinting

Identify Threats at the Protocol Level

Name: JA4+
Author: ThreatRelay

FoxIO Labs provides cutting-edge education, training, and hands-on labs in JA4+ network fingerprinting -- the methods used by Fortune 500 companies including Microsoft, Amazon, and Google to detect bots, proxies, and hacking tools.

Inbound Detection Guide Start Labs

Fingerprint Methods

500+

Fortune Companies

Open

Source Core

JA4+ Network Fingerprinting Explained

Watch John Althouse, creator of JA3 and JA4+, explain how protocol-level fingerprinting identifies threats that traditional methods miss.

Presented by John Althouse, creator of JA3 and JA4+

What JA4+ Detects

Residential Proxies

Per-session identification of traffic traversing residential proxy networks

Bots & Hacking Tools

Detect intercepting proxies like Evilginx, Sliver C2, and spoofed User-Agents

VPN Fingerprinting

Identify VPN technologies by MSS overhead -- OpenVPN, WireGuard, NordVPN

Client Geolocation

Estimate client-to-server distance using light-speed latency measurements

Full Detection Guide

The JA4+ Fingerprinting Suite

A comprehensive set of network fingerprinting methods maintained full-time by FoxIO

Method	Short Name	Description	Status
JA4	JA4	TLS Client Fingerprinting	Active
JA4Server	JA4S	TLS Server Response / Session Fingerprinting	Active
JA4HTTP	JA4H	HTTP Client Fingerprinting	Active
JA4Latency	JA4L	Client to Server Latency / Light Distance	Active
JA4LatencyServer	JA4LS	Server to Client Latency / Light Distance	Active
JA4X509	JA4X	X509 TLS Certificate Fingerprinting	Active
JA4SSH	JA4SSH	SSH Traffic Fingerprinting	Active
JA4TCP	JA4T	TCP Client Fingerprinting	Active
JA4TCPServer	JA4TS	TCP Server Response Fingerprinting	Active
JA4TCPScan	JA4TScan	Active TCP Fingerprint Scanner	Active
JA4DHCP	JA4D	DHCP Fingerprinting	Active
JA4DHCPv6	JA4D6	DHCPv6 Fingerprinting	Active
JA4Scan	JA4Scan	Active TLS Server Fingerprint Scanner	In Dev
JA4Email	JA4E	Email Header Fingerprinting	In Dev
JA4HTTPServer	JA4HS	HTTP Server Response Fingerprint	Backlog
JA4WiFi	JA4W	Wireless Client Fingerprint	Backlog
JA4BGP	JA4B	BGP Fingerprinting	Backlog
JA4IPv6	JA46	IPv6 Fingerprinting	Backlog

View on GitHub JA4 Database

Inbound Threat Detection

Use JA4+ to identify inbound bots, fraud, hacking tools, session hijacking, and proxied traffic at the protocol level

Proxy Detection

Detect residential proxied traffic on a per-session basis by analyzing JA4T, JA4L, and User-Agent discrepancies. Identify when the proxy OS does not match the claimed client OS.

Example: Proxied Connection

JA4T: 65535_2-4-8-1-3_1460_4

Claimed Windows, but JA4T = Android

Bot & Tool Detection

Browsers include ALPN in TLS ClientHello (JA4_a ends in h1/h2/h3). Non-browsers end in 00. Browsers prefer HTTP/2+ and list accept-language. Bots and hacking tools do not.

Example: Evilginx detected

JA4H: ge10nn100000

No language, HTTP/1.0 = not a browser

VPN Fingerprinting

VPN overhead reduces MSS by a fixed amount. A JA4T_c (MSS) below 1300 indicates VPN traffic. Specific JA4T fingerprints identify WireGuard, OpenVPN, NordVPN, and iCloud Relay.

Example: WireGuard detected

JA4T: 65340_2-1-3-1-1-4_1210_8

MSS=1210 < 1300 = VPN overhead

Light Distance / Geolocation

JA4L measures latency in microseconds between the TCP and application handshakes to estimate physical distance. Formula: D = jc/p where c = 0.128 miles per microsecond in fiber.

Example: Proxy distance

JA4L: 5191_42_45014

Proxy 415mi, Client 3,185mi away

OS Identification

Identify client operating systems passively using TCP window scale options and observed TTL values, independent of User-Agent strings which are easily spoofed.

JA4T TCP Options

*_2-1-3-1-1-4_* = Windows

*_2-4-8-1-3_* = Linux

Session Hijacking

Intercepting proxies like Evilginx initiate all communication to the server. All fingerprints observed server-side become the proxy program fingerprint, exposing the attack.

Example: Sliver C2

UA: Safari/macOS but JA4T=Windows

JA4H reveals GoLang, not Safari

Read the Full Detection Guide