JA4 TLS client fingerprint

t12i130500_2d7513195f68_021165082e1c

Seen 2026-02-21 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS211680 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

106

Events

IPs / network

Top networks

AS211680 Sistemas Informaticos, S.A.28 IPs59

AS21859 Zenlayer Inc9 IPs12

AS10439 CariNet, Inc.7 IPs31

AS14061 DigitalOcean, LLC1 IPs4

Countries

PT 37US 7NL 1

Ports targeted

443/tcp 51 8443/tcp 18 9443/tcp 18 4443/tcp 10 10443/tcp 7 80/tcp 1 8000/tcp 1

What it requests

GET/97

GET/favicon-32x32.png9

User agents claimed

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.3637 IPs71

Mozilla/5.0 zgrab/0.x7 IPs31

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.361 IPs4

Source IPCCNetwork Last seenEvents

66.240.223.214AS0 CariNet, Inc.2026-09-168

45.156.128.129AS0 Sistemas Informaticos, S.A.2026-09-036

45.156.129.56AS0 Sistemas Informaticos, S.A.2026-09-026

71.6.199.87AS0 CariNet, Inc.2026-09-226

66.240.236.109AS0 CariNet, Inc.2026-09-225

45.156.129.133AS0 Sistemas Informaticos, S.A.2026-09-035

45.156.129.132AS0 Sistemas Informaticos, S.A.2026-09-024

45.156.128.113AS0 Sistemas Informaticos, S.A.2026-09-174

68.183.0.17AS0 DigitalOcean, LLC2026-09-014

66.240.236.116AS0 CariNet, Inc.2026-09-244

71.6.199.65AS0 CariNet, Inc.2026-09-013

45.156.129.134AS0 Sistemas Informaticos, S.A.2026-09-033

66.240.223.208AS0 CariNet, Inc.2026-09-153

45.156.128.37AS0 Sistemas Informaticos, S.A.2026-09-033

45.156.129.179AS0 Sistemas Informaticos, S.A.2026-09-143

185.226.197.75AS0 Zenlayer Inc2026-09-012

66.240.223.240AS0 CariNet, Inc.2026-09-172

45.156.129.172AS0 Sistemas Informaticos, S.A.2026-09-152

185.226.197.72AS0 Zenlayer Inc2026-09-012

45.156.128.117AS0 Sistemas Informaticos, S.A.2026-08-292

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.