JA4 TLS client fingerprint

t13d190900_9dc949149365_97f8aa674fd9

Seen 2026-03-06 to 2026-10-06 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS398324 sends an email when it next hits a sensor.

Known fingerprint

[GoLang]

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

Top networks

AS398324 Censys, Inc.9 IPs9

AS398722 Censys, Inc.5 IPs5

AS16509 Amazon.com, Inc.2 IPs3

AS6405 American Information Network1 IP3

AS48090 Techoff Srv Limited1 IP2

AS398705 Censys, Inc.1 IP1

AS47890 Unmanaged Ltd1 IP1

Countries

US 18NL 1RO 1

Ports targeted

443/tcp 17 80/tcp 7

What it requests

GET/18

GET/.git/config6

User agents claimed

Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)15 IPs15

visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.362 IPs3

Mozilla/5.0 (iPad; U; CPU OS 4_2_1 like Mac OS X; ja-jp) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C148 Safari/6533.18.51 IP1

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.15 Safari/534.131 IP1

Mozilla/5.0 (compatible; archive.org_bot; Wayback Machine Live Record; +http://archive.org/details/archive.org_bot)1 IP1

Source IPCCNetwork Last seenEvents

154.54.100.187USAS6405 American Information Network2026-09-303

45.148.10.120NLAS48090 Techoff Srv Limited2026-09-242

3.139.242.79USAS16509 Amazon.com, Inc.2026-09-282

3.151.194.164USAS16509 Amazon.com, Inc.2026-09-231

66.132.186.174USAS398324 Censys, Inc.2026-10-041

199.45.155.21USAS398722 Censys, Inc.2026-09-261

66.132.186.184USAS398324 Censys, Inc.2026-10-041

199.45.154.55USAS398722 Censys, Inc.2026-10-031

199.45.155.52USAS398722 Censys, Inc.2026-09-231

66.132.172.185USAS398324 Censys, Inc.2026-10-051

66.132.224.237USAS398324 Censys, Inc.2026-09-261

199.45.154.56USAS398722 Censys, Inc.2026-09-271

199.45.154.47USAS398722 Censys, Inc.2026-09-271

66.132.195.86USAS398324 Censys, Inc.2026-09-291

66.132.172.214USAS398324 Censys, Inc.2026-10-061

66.132.172.210USAS398324 Censys, Inc.2026-09-271

66.132.195.31USAS398324 Censys, Inc.2026-10-031

193.32.162.156ROAS47890 Unmanaged Ltd2026-10-031

167.94.146.59USAS398705 Censys, Inc.2026-09-231

66.132.224.90USAS398324 Censys, Inc.2026-09-281

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.