what is tls fingerprinting?
identifying the software behind a connection from the details of its tls handshake, before a single http byte is sent.
the client hello advertises a tls version, an ordered list of cipher suites, extensions, supported curves and signature algorithms. every implementation picks a different combination: openssl, go's crypto/tls, python requests, curl, chrome and firefox are all distinguishable at a glance. hashing those fields produces a compact signature, which is what ja3 and the newer ja4 do, and cdns compute it at the edge and match it against known clients. so if your handshake says python while your user-agent header says chrome 141, you are caught before the request is even parsed, and no amount of header editing will help. the fixes are all client side: drive a real browser, or use a client built to imitate one, such as curl-impersonate, tls-client or anything built on utls. a proxy cannot change this, since it tunnels your bytes and the handshake is yours. it is a common reason clean residential ips still get blocked.