JA4 TLS client fingerprint

t12i280900_0df5e5c63df4_f30da352415d

Seen 2026-09-25 to 2026-09-28 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS210006 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

109

Ports hit

3.8K

Events

IPs / network

Top networks

AS210006 Shereverov Marat Ahmedovich10 IPs1.5K

AS132359 M/S ROBI TRADERS7 IPs978

AS153947 FAST ZONE IT5 IPs716

AS153622 Madina IT5 IPs608

Countries

TR 17DE 7SC 3

Ports targeted

443/tcp 68 22443/tcp 51 30443/tcp 46 28443/tcp 46 42443/tcp 44 56443/tcp 43 643/tcp 43 17443/tcp 43 8080/tcp 42 3872/tcp 41 57443/tcp 41 8088/tcp 41

What it requests

GET/1.2K

GET/+CSCOE+/logon.html1.1K

GET/remote/login784

GET/api/sonicos/is-sslvpn-enabled608

GET/RDWeb12

User agents claimed

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.3627 IPs3.8K

Source IPCCNetwork Last seenEvents

45.154.244.145SCAS210006 Shereverov Marat Ahmedovich2026-09-28208

178.20.210.194DEAS210006 Shereverov Marat Ahmedovich2026-09-28205

178.20.210.183DEAS210006 Shereverov Marat Ahmedovich2026-09-28204

193.32.204.146TRAS153622 Madina IT2026-09-28202

46.29.26.138TRAS132359 M/S ROBI TRADERS2026-09-28202

178.20.210.145DEAS210006 Shereverov Marat Ahmedovich2026-09-28198

193.187.110.132TRAS153947 FAST ZONE IT2026-09-28194

46.29.26.171TRAS132359 M/S ROBI TRADERS2026-09-28182

46.29.26.150TRAS132359 M/S ROBI TRADERS2026-09-28161

193.32.204.131TRAS153622 Madina IT2026-09-28159

46.29.26.140TRAS132359 M/S ROBI TRADERS2026-09-28158

193.187.110.153TRAS153947 FAST ZONE IT2026-09-28153

193.187.110.147TRAS153947 FAST ZONE IT2026-09-28152

178.20.210.173DEAS210006 Shereverov Marat Ahmedovich2026-09-28132

46.29.26.149TRAS132359 M/S ROBI TRADERS2026-09-28128

193.32.204.168TRAS153622 Madina IT2026-09-28125

45.154.244.160SCAS210006 Shereverov Marat Ahmedovich2026-09-28123

178.20.210.155DEAS210006 Shereverov Marat Ahmedovich2026-09-28122

193.187.110.148TRAS153947 FAST ZONE IT2026-09-28117

45.154.244.156SCAS210006 Shereverov Marat Ahmedovich2026-09-28112

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.