What it detects
A single source rotating many JA3 fingerprints across TLS connections.
Why it fires
A signal of fingerprint evasion, botnet or automated clients.
Worst case
Fingerprint evasion · botnet
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.