FoxIO JA4 is a network fingerprinting tool designed to identify TLS clients and other network characteristics, part of the JA4+ suite which includes various protocol-specific fingerprinting methods such as TLS, HTTP, SSH, and TCP. It enables the identification of operating systems, devices, applications, and hosting environments, while also detecting intermediaries like VPNs, proxies, and tunnels. JA4 provides enhanced robustness and adaptability compared to its predecessor JA3, supporting modern transport protocols like QUIC, and is designed to be interpretable by both humans and machines for threat detection, traffic analysis, and security enforcement.
