Blacklists

`lookup_ja3_blacklist`

Check the JA3 blacklist: is this JA3 MD5 fingerprint associated with malware or C2 activity? A match indicates the TLS client fingerprint has been observed in connection with known malicious infrastructure. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Response shape: jsonb

Parameters

ja3_md5stringrequired

JA3 MD5 fingerprint to check, exactly 32 hexadecimal characters (pattern ^[0-9a-fA-F]{32}$). Lowercased server-side before lookup.

Example invocation

Ask your agent: "Is the JA3 fingerprint a0e9f5d64349fb13191bc781f81f42e1 on the blacklist?"

curl -s https://api.edgeprotect.io/functions/v1/mcp \
  -H "Authorization: Bearer $EDGEPROTECT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"lookup_ja3_blacklist","arguments":{"ja3_md5":"a0e9f5d64349fb13191bc781f81f42e1"}}}'

Response

{
  "ja3_md5": "a0e9f5d64349fb13191bc781f81f42e1",
  "listed": true,
  "first_seen": "2024-08-12T00:00:00Z",
  "last_seen": "2025-01-04T00:00:00Z",
  "listing_reason": "TrickBot C2",
  "generated_at": "2026-05-29T10:14:03.221Z"
}

{
  "ja3_md5": "a0e9f5d64349fb13191bc781f81f42e1",
  "listed": false,
  "generated_at": "2026-05-29T10:14:03.221Z"
}

A well-formed fingerprint that is not on the blacklist returns a successful response with "listed": false.

The full MCP envelope is described in Response Format.

Errors

Code	Message	When
`-32602`	`invalid_params: ja3_md5: required_string`	`ja3_md5` was not supplied
`-32602`	`invalid_params: ja3_md5: pattern`	Value is not a 32-character hex string
`-32001`	`unauthorized`	API key is invalid, revoked, or the request IP is not on the allowlist
`-32002`	`insufficient_credits`	Credit balance is zero; top up from the dashboard
`-32603`	`internal`	Unexpected server error

Argument-validation errors (-32602) are never charged. See Errors for the full reference.