CrewAI orchestrates multiple AI agents working together. Each agent typically makes independent HTTP requests, producing a distinctive pattern of parallel TLS connections from the same source IP.
| Component | JA4 | HTTP Client |
|---|---|---|
| CrewAI Agent (httpx) | t13d3514h2_bfa337485184_* | Python httpx |
| CrewAI Tool calls | t13d351300_bfa337485184_* | Python requests/urllib3 |
| CrewAI Browser tool | Varies (browser fingerprint) | Playwright/Selenium |
CrewAI crews produce unique traffic patterns: multiple rapid HTTP connections from the same IP with varying User-Agent strings but identical JA4 fingerprints. CounterAgent detects this as a "multi-agent cluster" signal.