JA4 TLS client fingerprint
t12i280900_0df5e5c63df4_f30da352415d
Seen 2026-09-25 to 2026-09-28 across the retained window.
The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS210006 sends an email when it next hits a sensor.
27
Source IPs
4
Networks
3
Countries
109
Ports hit
3.8K
Events
7
IPs / network
Top networks
Countries
TR 17DE 7SC 3
What it requests
User agents claimed
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.3627 IPs3.8K
Source IPCCNetwork
Last seenEvents
About this fingerprint
JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.