Detection
JA3 / JA4 Fingerprint
JA3, and its successor JA4, are TLS fingerprinting methods that summarize the exact ordering and values of a client's TLS ClientHello — cipher list, extensions, ALPN — into a short digest, without requiring any client-side JavaScript at all, since it comes from the raw TLS handshake itself. A genuine, unmodified, current install of Chrome, Firefox, Safari, or Edge always negotiates TLS in a small number of predictable, well-known shapes; a JA4 digest that doesn't match any of them is a cross-check signal against the claimed User-Agent that the connection isn't coming from a real, unmodified browser.