JA4 TLS client fingerprint
t13d131000_f57a46bbacb6_e7c285222651
Seen 2026-04-09 to 2026-10-21 across the retained window.
The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS215599 sends an email when it next hits a sensor.
21
Source IPs
10
Networks
10
Countries
2
Ports hit
29
Events
2
IPs / network
Top networks
Countries
Ports targeted
What it requests
User agents claimed
Interaction
Sessions
Sessions in the last 30 days in which a sensor answered as a product and recorded what a client with this fingerprint did once inside. Logged in, ran commands, named a download and handed over files each count sessions. Reported beside the counts above and never added to them.
67
Sessions
4
Source IPs
0
Logged in
0
Ran commands
0
Named a download
0
Handed over files
Services
ATT&CK techniques
1 technique, 1 tacticWhat the sessions did in MITRE ATT&CK terms. The sensors map each session from its verdict, its labels and what it named, so one session can show several techniques. The count is sessions.
Source IPs in these sessions
most sessions firstAbout this fingerprint
JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.