JA4 TLS client fingerprint

t13d311100_e8f1e7e78f70_d41ae481755e

Seen 2026-05-04 to 2026-10-15 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS8075 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

Top networks

AS8075 Microsoft Corporation19 IPs27

AS16509 Amazon.com, Inc.1 IP8

AS36352 HostPapa1 IP5

AS24940 Hetzner Online GmbH1 IP2

AS7545 TPG Telecom Limited1 IP1

Countries

US 20DE 2AU 1

Ports targeted

443/tcp 31 2223/tcp 4 2224/tcp 4 4443/tcp 1 5001/tcp 1 8443/tcp 1 10443/tcp 1

What it requests

GET/robots.txt16

GET/14

GET/btc-pool5

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot10 IPs16

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)9 IPs11

Mozilla/5.02 IPs6

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.361 IP2

Source IPCCNetwork Last seenEvents

18.194.240.245DEAS16509 Amazon.com, Inc.2026-10-148

23.94.99.34USAS36352 HostPapa2026-10-015

74.7.230.8USAS8075 Microsoft Corporation2026-09-293

74.7.175.133USAS8075 Microsoft Corporation2026-09-293

74.7.243.245USAS8075 Microsoft Corporation2026-10-052

74.7.241.173USAS8075 Microsoft Corporation2026-10-052

74.7.242.54USAS8075 Microsoft Corporation2026-09-292

178.105.158.28DEAS24940 Hetzner Online GmbH2026-09-252

74.7.241.183USAS8075 Microsoft Corporation2026-09-242

74.7.241.182USAS8075 Microsoft Corporation2026-10-141

74.7.244.16USAS8075 Microsoft Corporation2026-09-231

74.7.227.189USAS8075 Microsoft Corporation2026-09-281

74.7.242.27USAS8075 Microsoft Corporation2026-10-151

74.7.227.147USAS8075 Microsoft Corporation2026-09-241

74.7.175.167USAS8075 Microsoft Corporation2026-10-151

74.7.244.26USAS8075 Microsoft Corporation2026-10-061

74.7.243.128USAS8075 Microsoft Corporation2026-10-061

74.7.228.20USAS8075 Microsoft Corporation2026-09-241

74.7.227.181USAS8075 Microsoft Corporation2026-10-021

58.6.253.175AUAS7545 TPG Telecom Limited2026-10-051

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.