Your machine and the server negotiate the HTTPS connection with a handshake (Client Hello) including supported cipher suites and extensions.
Category: WAF Evasion đŻ Trench â Your machine and the server negotiate the HTTPS connection with a handshake (Client Hello) including supported cipher suites and extensions. Chrome does this in a mathematically unique way. Python (requests) in another. Cloudflare knows who
you are before you send a single header.
đ Kill chain â Defensive recon. If your JA3 screams âPythonâ
and your User-Agent says âChromeâ, the WAF flags you as a bot
with very high confidence.
đĄ Defensive footprint â Cloudflare Bot Management, Akamai
Bot Manager, DataDome â all use JA3/JA4 as primary signal. Not a
log, a real-time scoring system.
â ď¸ False friend â Thinking that changing User-Agent in
requests.get() makes you look like a browser. JA3 betrays you in
milliseconds.
đĄď¸ Remediation (offensive) â Use curl-impersonate, real
headless browsers (Playwright/Selenium with stealth plugins), or
libraries that rebind the TLS stack.
â Back to the full glossary Last updated: 2026-06-11