JA3/JA4 are TLS Client Hello fingerprinting algos. Scanners / malicious bots have stable fingerprints. NK Personal+.
JA3 vs JA4
- JA3 — old, TLS 1.2 field ordering, 32-char hex hash
- JA4 — new (2023+), stable across TLS 1.3 + GREASE, format
t13d1516h2_8daaf6152771_b1ff8ab2d16f
Blocklist management
api/ja3-blocklist/create body: provide ja3_hash and/or ja4_hash (at least one), label as note.
Scope
- Global: any enabled fingerprint blocks across all sites
- Per-site: microservice-site.ja3_blocklist_ids array, blocks only this site