JA4 TLS client fingerprint

t12i210600_76e208dd3e22_2dae41c691ec

Seen 2026-03-10 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS9009 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

440

Ports hit

786

Events

IPs / network

Top networks

AS9009 M247 Europe SRL20 IPs429

AS212238 Datacamp Limited5 IPs159

AS40934 Fortinet Inc.1 IPs180

AS36352 HostPapa1 IPs17

AS12389 Rostelecom1 IPs1

Countries

IR 13RU 8DE 3US 2AT 1UA 1

Ports targeted

443/tcp 33 80/tcp 30 4435/tcp 24 6443/tcp 14 4439/tcp 12 4437/tcp 12 4430/tcp 12 3443/tcp 12 2443/tcp 12 1443/tcp 12 8443/tcp 7 2096/tcp 7

What it requests

GET/678

GET/login?redir=%2F90

GET/RDWeb/Pages/en-US/login.aspx17

GET/Auth1.html1

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.025 IPs588

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.01 IPs1

Source IPCCNetwork Last seenEvents

69.167.107.32AS0 Fortinet Inc.2026-09-09180

37.19.223.8AS0 Datacamp Limited2026-09-21105

146.70.52.246AS0 M247 Europe SRL2026-09-2371

146.70.52.220AS0 M247 Europe SRL2026-09-2362

62.133.46.22AS0 M247 Europe SRL2026-09-2260

62.133.46.27AS0 M247 Europe SRL2026-09-2358

62.133.46.14AS0 M247 Europe SRL2026-09-2334

158.173.155.33AS0 Datacamp Limited2026-09-2333

62.133.46.3AS0 M247 Europe SRL2026-09-1930

62.133.46.5AS0 M247 Europe SRL2026-09-2329

146.70.52.235AS0 M247 Europe SRL2026-09-1921

158.173.156.31AS0 Datacamp Limited2026-09-0819

192.3.194.39AS0 HostPapa2026-09-0517

62.133.46.29AS0 M247 Europe SRL2026-09-2315

146.70.52.117AS0 M247 Europe SRL2026-09-2313

62.133.46.24AS0 M247 Europe SRL2026-09-229

146.70.52.203AS0 M247 Europe SRL2026-09-137

62.133.46.16AS0 M247 Europe SRL2026-09-247

146.70.52.46AS0 M247 Europe SRL2026-09-244

62.133.46.15AS0 M247 Europe SRL2026-09-243

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.