JA4 fingerprint

t13i190800_9dc949149365_97f8aa674fd9

Sliver - a known offensive-security / C2 tool.

TCP · TLS 1.3, no SNI (IP), 19 cipher suites, 08 extensions, none offered ALPN.

Try:

Anatomy

t13i190800_9dc949149365_97f8aa674fd9
tTransportThe protocol carrying the handshake - t for TCP, q for QUIC (HTTP/3), d for DTLS.TCP
13TLS versionThe highest TLS version the client offered, from the supported_versions extension - 13 is TLS 1.3, 12 is TLS 1.2.TLS 1.3
iSNIWhether the client sent a Server Name Indication - d if it named a domain, i if it connected to a bare IP.no SNI (IP)
19CiphersHow many cipher suites the client offered (GREASE values excluded). The exact list is hashed into the first JA4 hash.19 suites offered
08ExtensionsHow many TLS extensions the client sent (GREASE excluded, and SNI and ALPN are not counted). The list is hashed into the second JA4 hash.8 present
00ALPNThe first application protocol the client advertised - h2 is HTTP/2, h1 is HTTP/1.1, h3 is HTTP/3, 00 is none.none offered

9dc949149365 is a SHA-256 of the sorted cipher list · 97f8aa674fd9 covers the extensions and signature algorithms. Hashes aren't reversible - the identity below comes from matching them.

Identity

from FoxIO ja4db
Sliver
Known offensive / C2 tool

Sliver is the published identity for this exact fingerprint in FoxIO's ja4db - a known mapping, not a guess.

Family
go
Confidence
Exact match · full JA4
Matched on
full JA4 hash
Verified
yes - FoxIO published mapping

Sliver C2 agent (Go), connecting without SNI. Shares generic Go’s crypto/tls JA4.

Get hundreds of insights

connection_fingerprint: {
ja4: {
hash: "t13i190800_9dc949149365_97f8aa674fd9",
family: "go",
},
user_agent_alignment: "?", // needs a live request
h2_fingerprint: "?", // needs a live request
}

A JA4 is one clue. Foil checks hundreds more - the network, the device, and how the session behaves - and tells you when they don't add up. That's usually where the bots are.

See it on a real session - free →

What to do

Block

Treat as malicious until proven otherwise. Block the connection at the edge and raise a high-priority alert to your security team.

Then pivot: enrich the source IP (hosting/ASN, geo, reputation), search for every other session sharing this JA4, IP, or device cluster, and look for beaconing - regular intervals, small fixed payloads. If it’s on an internal or egress network the source host is likely compromised, so isolate it and begin incident response. Note that Go-based C2 shares a generic Go JA4, so corroborate with the destination, JA4S/JA4H, timing, and payload before attributing it to a specific tool.

About this fingerprint

Sliver C2 agent (Go), connecting without SNI. Shares generic Go’s crypto/tls JA4.

The breakdown above is computed from the string itself: the readable JA4_aprefix gives the transport, TLS version, SNI flag, cipher and extension counts, and ALPN, while the two hashes are matched against Foil's reference database to name the client. For the full background, see TLS fingerprinting, or try any fingerprint of your own in the JA4 database.

Both component hashes can be looked up on their own: cipher hash 9dc949149365 lists every fingerprint built on this cipher stack, and extension hash 97f8aa674fd9 lists the variants that share this extension set.

Frequently asked

JA4 is a fingerprint of the TLS ClientHello a client sends before any HTTP. It is a three-part string, JA4_a_JA4_b_JA4_c: a readable prefix (transport, TLS version, SNI, cipher and extension counts, ALPN) followed by two truncated SHA-256 hashes over the sorted cipher and extension lists. Unlike JA3, it survives Chrome's extension-order randomization.

The JA4_a prefix decodes by eye: the first character is the transport, the next two are the TLS version, then SNI, a two-digit cipher count, a two-digit extension count, and the first ALPN value. The two hashes are not reversible; you identify them by matching against a database or by decoding the raw (JA4_r) variant.

A JA3 fingerprint is an MD5 hash of the handshake, so the hash itself carries no readable structure. Only the raw JA3 string (version, ciphers, extensions, curves, point formats) can be decoded back into its components.

Yes. Fingerprints are matched against a distilled reference database of common browsers, HTTP libraries, and automation tools. The match tells you what a client is; identifying whether it is lying about that requires cross-checking against the User-Agent, HTTP/2 fingerprint, and JavaScript environment in a live request.