API Reference

Look up the JA3 Blacklist

Check the JA3 Blacklist to determine whether a JA3 MD5 TLS client fingerprint has been observed in connection with known malicious infrastructure such as malware or command-and-control activity.

GET

/v1/blacklist/ja3/{md5}

Cost: 1 credit per successful call

Path parameters

md5stringrequired

JA3 MD5 fingerprint to check. Must be exactly 32 hexadecimal characters (pattern ^[0-9a-f]{32}$). Input is case-insensitive and normalised to lowercase server-side before lookup.

Request

curl https://api.precursorintelligence.com/functions/v1/blacklist/ja3/a0e9f5d64349fb13191bc781f81f42e1 \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "ja3_md5": "a0e9f5d64349fb13191bc781f81f42e1",
    "listed": true,
    "first_seen": "2024-08-12T00:00:00Z",
    "last_seen": "2025-01-04T00:00:00Z",
    "listing_reason": "TrickBot C2",
    "generated_at": "2026-05-29T10:14:03.221Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

A well-formed fingerprint that is not on the blacklist returns a successful response in which listed is false and only that field, the echoed ja3_md5, and generated_at are present:

200 OK (no match)

{
  "data": {
    "ja3_md5": "a0e9f5d64349fb13191bc781f81f42e1",
    "listed": false,
    "generated_at": "2026-05-29T10:14:03.221Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.ja3_md5stringoptional

The JA3 MD5 fingerprint that was looked up, echoed back in lowercase.

data.listedbooleanoptional

Whether the fingerprint is present on the JA3 Blacklist. When false, only ja3_md5, listed, and generated_at are returned.

data.first_seenstringoptional

ISO 8601 timestamp of the first observation of this fingerprint on the blacklist. Present only when listed is true.

data.last_seenstringoptional

ISO 8601 timestamp of the most recent observation of this fingerprint. Present only when listed is true.

data.listing_reasonstringoptional

The malware family or threat associated with the listing (for example, TrickBot C2). Present only when listed is true.

data.generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Status	`error`	When
400	`invalid_ja3_md5`	The path segment is not a valid 32-character hex string.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.