TLS fingerprinting, primarily JA4 today, since it’s resilient to the extension-order randomization that modern browsers use and that made the older JA3 method less reliable, analyzes the specific parameters of the TLS handshake, including cipher suites and extensions, to identify the client application. This helps identify bots that claim to be a standard web browser (like Chrome) but technically behave like a script (like Python or curl) during the secure connection establishment.