JA4 TLS client fingerprint

t13d301300_1d37bd780c83_5ae85263eb3b

Seen 2026-07-14 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

306

Source IPs

Networks

Countries

Ports hit

614

Events

306

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS14061 DigitalOcean, LLC306 IPs614

Countries

US 242NL 23GB 14CA 10IN 9DE 8

Ports targeted

995/tcp 98 465/tcp 94 8443/tcp 94 443/tcp 92 8883/tcp 88 993/tcp 74 3389/tcp 74

What it requests

GET/307

GET/favicon.ico307

User agents claimed

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36211 IPs422

Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.089 IPs180

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.366 IPs12

Source IPCCNetwork Last seenEvents

159.89.229.22AS0 DigitalOcean, LLC2026-09-094

144.126.209.129AS0 DigitalOcean, LLC2026-09-202

46.101.175.88AS0 DigitalOcean, LLC2026-08-302

164.92.207.173AS0 DigitalOcean, LLC2026-09-012

159.203.184.218AS0 DigitalOcean, LLC2026-08-272

64.227.105.81AS0 DigitalOcean, LLC2026-09-062

188.166.2.16AS0 DigitalOcean, LLC2026-09-242

164.92.92.211AS0 DigitalOcean, LLC2026-09-162

188.166.68.6AS0 DigitalOcean, LLC2026-09-022

137.184.80.86AS0 DigitalOcean, LLC2026-09-222

64.23.194.8AS0 DigitalOcean, LLC2026-09-202

45.55.46.193AS0 DigitalOcean, LLC2026-09-032

24.199.89.222AS0 DigitalOcean, LLC2026-09-152

24.144.88.224AS0 DigitalOcean, LLC2026-09-152

157.230.224.194AS0 DigitalOcean, LLC2026-08-262

137.184.177.123AS0 DigitalOcean, LLC2026-09-032

146.190.57.240AS0 DigitalOcean, LLC2026-09-172

164.90.159.83AS0 DigitalOcean, LLC2026-09-132

134.199.233.216AS0 DigitalOcean, LLC2026-09-062

167.99.190.243AS0 DigitalOcean, LLC2026-08-272

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.