JA4+ is a suite of network fingerprinting methods by FoxIO that are easy to use and easy to share. These methods are both human and machine readable to facilitate more effective threat-hunting and analysis. The use-cases for these fingerprints include scanning for threat actors, malware detection, session hijacking prevention, compliance automation, location tracking, DDoS detection, grouping of threat actors, reverse shell detection, and many more.

For a quick explainer on JA4+ and to use as a reference during analysis see:
JA4+ Cheat Sheet

For in-depth detail, please read our blogs on how JA4+ works, why it works, and examples of what can be detected/prevented with it:
JA4+ Network Fingerprinting (JA4/S/H/L/X/SSH)
JA4T: TCP Fingerprinting (JA4T/TS/TScan)
Investigating Surfshark and NordVPN with JA4T (JA4T)
JA4D and JA4D6: DHCP Fingerprinting (JA4D/6)

If you love JA4+, consider getting a t-shirt or hoodie:
JA4+ Shirts, Hoodies, and Stickers

• Current methods and implementation details
• Implementations
• Tools that support JA4+
• Examples
• Plugins
• Binaries
  • Release Assets
  • Installing tshark
    • Linux
    • macOS
    • Windows
  • Running JA4+
• Database
• Release Process
  • How to Create a Release
• JA4+ Details
• Licensing
• Q&A
• JA4+ was created by