Peakhour.IO - TLS Fingerprinting

What an Open Network Fingerprint Database Should Publish

AC — Sun, 06 Sep 2026 09:00:00 +1000

A useful open fingerprint database needs provenance, competing labels, raw evidence, format versions and licences—not another unexplained hash list.

Public Fingerprint Databases Are Not Ground Truth

AC — Sun, 30 Aug 2026 09:00:00 +1000

We reviewed the main public fingerprint resources. The formats are open, but current application labels and auditable ground truth remain scarce.

Using Network Fingerprints in Bot and Rate-Limit Decisions

AC — Sun, 23 Aug 2026 09:00:00 +1000

A practical way to use network fingerprints for bot and rate-limit decisions without mistaking a shared client cohort for identity.

Does TLS Fingerprint Canonicalisation Hide Attacker Variation? How to Test It

AC — Sun, 16 Aug 2026 09:00:00 +1000

Sorting makes TLS fingerprints more stable, but it also removes ordering evidence. Here is how to test whether the discarded variation matters.

A Network Fingerprint Is a Cohort, Not a Client

AC — Sun, 09 Aug 2026 09:00:00 +1000

TLS fingerprints group similar protocol implementations. They do not prove which application, device or person made a request.

From Joy to Mercury and EVE: Following Cisco's Network Fingerprinting Work

AC — Sun, 02 Aug 2026 09:00:00 +1000

Cisco's open-source collectors, fingerprinting research and Encrypted Visibility Engine form a clear lineage, but they are not interchangeable parts of one public system.

Two Lineages of TLS Fingerprinting: JA3, JA4 and Cisco Mercury

AC — Sun, 26 Jul 2026 09:00:00 +1000

JA4 did not descend from Cisco Mercury. The two projects come from different strands of TLS fingerprinting research and solve different operational problems.

Before JA3: How TLS Handshakes Became Fingerprints

AC — Sun, 19 Jul 2026 09:00:00 +1000

JA3 made TLS fingerprints easy to log and share, but the technical ideas behind it had already been tested in SSL Labs experiments, a p0f patch and FingerprinTLS.

One ClientHello, Three Fingerprints: JA3, JA4 and Mercury

AC — Sun, 12 Jul 2026 09:00:00 +1000

A reproducible lab runs JA3, JA4 and Cisco Mercury against the same TLS ClientHello and compares what each fingerprint preserves.

The Invisibility Cloak

AC — Mon, 01 Sep 2025 00:00:00 +1000

Learn how attackers combine residential proxies and anti-detect browsers to evade detection and how modern security tools can fight back.

How MTU Fingerprinting Identifies VPNs and Mobile Users

AC — Wed, 15 Jan 2025 14:00:00 +1100

Learn how MTU fingerprinting reveals VPN usage, mobile connections, and network technologies through TCP handshake analysis. Discover practical SQL techniques for dynamic network intelligence.

RFC 9460

AC — Thu, 16 Nov 2023 00:00:00 +1100

Introducing SVCB and HTTPS records in DNS and their impact on web connectivity.

JA4 and JA4+ Network Fingerprinting

AC — Wed, 25 Oct 2023 13:00:00 +1100

How JA4 constructs a TLS client fingerprint, what JA4+ names, and which details sorting and hashing discard.

Efficiently Generating and Printing All IPv4 Addresses in a Random Order

AC — Mon, 15 May 2023 13:00:00 +1000

Explains how to efficiently generate all IPv4 addresses in a random order using a Linear Congruential Generator (LCG), a memory-efficient method for tasks like security testing and network simulation.

Chrome's TLS Extension Randomisation Experiment

AC — Thu, 02 Feb 2023 13:00:00 +1100

Does TLS extension randomisation assist in hiding Chrome?

TLS Fingerprinting

AC — Thu, 02 Feb 2023 13:00:00 +1100

What is fingerprinting, and in particular TLS fingerprinting?