JA3/JA4 Fingerprint
Your machine and the server negotiate the HTTPS connection with a handshake (Client Hello) including supported cipher suites and extensions.
Category: WAF Evasion 🎯 Trench — Your machine and the server negotiate the HTTPS connection with a handshake (Client Hello) including supported cipher suites and extensions. Chrome does this in a mathematically unique way. Python (requests) in another. Cloudflare knows who
you are before you send a single header.
🔗 Kill chain — Defensive recon. If your JA3 screams “Python”
and your User-Agent says “Chrome”, the WAF flags you as a bot
with very high confidence.
📡 Defensive footprint — Cloudflare Bot Management, Akamai
Bot Manager, DataDome — all use JA3/JA4 as primary signal. Not a
log, a real-time scoring system.
⚠️ False friend — Thinking that changing User-Agent in
requests.get() makes you look like a browser. JA3 betrays you in
milliseconds.
🛡️ Remediation (offensive) — Use curl-impersonate, real
headless browsers (Playwright/Selenium with stealth plugins), or
libraries that rebind the TLS stack.
← Back to the full glossary Last updated: 2026-06-11