JA4 TLS client fingerprint

t12i990600_c1f2c4f7e84d_7b0ba9b4cf08

Seen 2026-02-20 to 2026-09-23 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS4766 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

Top networks

AS4766 Korea Telecom25 IPs25

AS17858 LG POWERCOMM10 IPs10

AS4713 NTT DOCOMO BUSINESS,Inc.4 IPs4

AS3786 LG DACOM Corporation4 IPs4

AS2518 BIGLOBE Inc.2 IPs2

AS7679 QTnet,Inc.2 IPs2

AS9829 National Internet Backbone1 IPs1

AS34391 Paritel Operateur SAS1 IPs1

AS3215 Orange1 IPs1

AS10054 CMB Kwangju Broadcasting1 IPs1

AS6057 Administracion Nacional de Telecomunicaciones1 IPs1

AS2516 KDDI CORPORATION1 IPs1

Countries

KR 43JP 13AL 2FR 2IN 1MO 1NL 1LT 1AT 1BR 1

Ports targeted

443/tcp 24 8443/tcp 22 5001/tcp 13 8080/tcp 9

What it requests

GET/68

Source IPCCNetwork Last seenEvents

106.166.143.144AS0 KDDI CORPORATION2026-08-301

218.147.242.222AS0 Korea Telecom2026-09-081

106.255.191.179AS0 LG DACOM Corporation2026-09-191

89.249.87.82AS0 UAB Baltnetos komunikacijos2026-09-171

122.38.75.186AS0 LG POWERCOMM2026-09-061

14.36.164.158AS0 Korea Telecom2026-08-261

112.173.8.192AS0 Korea Telecom2026-09-191

121.171.40.162AS0 Korea Telecom2026-08-281

221.154.44.178AS0 Korea Telecom2026-09-191

59.190.66.181AS0 OPTAGE Inc.2026-09-221

220.76.216.47AS0 Korea Telecom2026-09-021

202.12.244.56AS0 GLBB Japan KK2026-08-261

175.192.244.140AS0 Korea Telecom2026-09-171

180.226.125.243AS0 LG POWERCOMM2026-09-121

125.198.87.197AS0 BIGLOBE Inc.2026-09-051

119.204.255.140AS0 Korea Telecom2026-08-261

221.146.13.170AS0 Korea Telecom2026-09-111

123.143.156.94AS0 LG DACOM Corporation2026-09-031

112.161.15.192AS0 Korea Telecom2026-09-231

49.246.41.13AS0 CMB Kwangju Broadcasting2026-09-151

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.