FoxIO-LLC/ja4
JA4+ is a suite of network fingerprinting standards
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
2 releases in the last 90 days, the latest 59 days ago, with 44 contributors on GitHub.
Gained 5% fewer stars in the last 90 days than in the 90 days before.
Use Cases & Benefits
- Provides a comprehensive suite of network fingerprinting methods for multiple protocols to enhance threat hunting and network security analysis.
- Delivers human and machine readable fingerprints that enable more precise detection and tracking of threat actors despite evasive tactics like cipher randomization.
- Use for detecting and grouping malware and threat actors by analyzing TLS, HTTP, SSH, and TCP fingerprints in network traffic.
- Use for integrating with network forensics tools like Zeek, Wireshark, and Arkime to automate threat detection and compliance monitoring.
- Use for developing custom security solutions that require detailed session fingerprinting and anomaly detection across diverse network protocols.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
Other
GitHub could not identify this license; read the LICENSE file before depending on it.
Community files
- README: present
Watch-outs
- License not identified by GitHub; read the LICENSE file before depending on it.
General guidance from repository metadata, not legal advice. How we score
From the README
JA4+ is a suite of network fingerprinting methods by FoxIO that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for threat actors, malware detection, session hijacking prevention, compliance automation, location tracking, DDoS detection, grouping of threat actors, reverse shell detection, and many more.
For a quick explainer on JA4+ and to use as a reference during analysis see: JA4+ Cheat Sheet
For in-depth detail, please read our blogs on how JA4+ works, why it works, and examples of what can be detected/prevented with it: JA4+ Network Fingerprinting (JA4/S/H/L/X/SSH) JA4T: TCP Fingerprinting (JA4T/TS/TScan) Investigating Surfshark and NordVPN with JA4T (JA4T)
If you love JA4+, consider getting a t-shirt or hoodie: JA4+ Shirts, Hoodies, and Stickers
The full name or short name can be used interchangeably. Additional JA4+ methods are in the works...
To understand how to read JA4+ fingerprints, see Technical Details
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
Forks
190+8
Open issues
23-3
Compared with peers in Security
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 1, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| cloudflare/security-audit-skill | 61.7K | +8.8K | 17 | — |
| KeygraphHQ/shannon | 51.2K | +1.1K | 32 | 8 days ago |
| vxcontrol/pentagi | 33.5K | +712 | 38 | 31 days ago |
| Asymptote-Labs/agent-beacon | 3.3K | +360 | 40 | today |
| caddyserver/caddy | 78.8K | +267 | 60 | 1 day ago |
| FoxIO-LLC/ja4 | 2.2K | — | 48 | 59 days ago |
| Category median | 51.2K | +712 | 38 | — |
Discover Repositories
Search across tracked repositories by name or description