JA4 TLS client fingerprint
t13d041000_16476d049b0b_78f1d400d464
Seen 2026-02-21 to 2026-09-24 across the retained window.
The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14618 sends an email when it next hits a sensor.
128
Source IPs
4
Networks
2
Countries
15
Ports hit
271
Events
32
IPs / network
Top networks
Countries
US 124NL 4
Source IPCCNetwork
Last seenEvents
About this fingerprint
JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.