Glossary

What Is TLS Fingerprint (JA3 / JARM)?

A TLS fingerprint (JA3 or JARM) is a compact hash of how a server or client negotiates a TLS handshake — a way to identify software and infrastructure even as IPs and domains change.

The exact way a system performs a TLS handshake — cipher order, extensions, versions — is distinctive. JA3 fingerprints the client side; JARM actively fingerprints the server side. The resulting short hash often stays constant as attackers rotate domains and IPs.

That makes TLS fingerprints a powerful pivot for tracking malware command-and-control and phishing kits. WhisperGraph stores `TLS_FINGERPRINT` nodes linked to the IPs that present them via `EMITS_TLS_FINGERPRINT`, so you can find every host sharing a fingerprint.

Workflows that use this

Runnable workflows where this concept does the work.

TLS-Fingerprint Infrastructure Pivot

Attackers change domains and addresses easily — but their servers often share a telltale fingerprint. Starting from one address, this pivots on that fingerprint to every other server sharing it, enriched with network and location, so you can cluster covert command-and-control infrastructure that would otherwise look unrelated.

SharePostLinkedInEmail