JA4 TLS client fingerprint

t13d450900_d524c25c267f_9da38b6fd1bc

Seen 2026-09-29 to 2026-10-13 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14618 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS14618 Amazon.com, Inc.23 IPs26

Countries

US 23

Ports targeted

443/tcp 26

What it requests

GET/robots.txt21

GET/5

User agents claimed

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (Gort)16 IPs19

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.367 IPs7

Source IPCCNetwork Last seenEvents

3.226.202.248USAS14618 Amazon.com, Inc.2026-10-082

52.203.246.32USAS14618 Amazon.com, Inc.2026-10-112

32.193.37.124USAS14618 Amazon.com, Inc.2026-10-022

3.212.128.164USAS14618 Amazon.com, Inc.2026-10-021

54.84.147.79USAS14618 Amazon.com, Inc.2026-10-071

100.26.66.245USAS14618 Amazon.com, Inc.2026-10-101

100.50.179.0USAS14618 Amazon.com, Inc.2026-10-091

3.216.210.239USAS14618 Amazon.com, Inc.2026-10-101

44.209.164.247USAS14618 Amazon.com, Inc.2026-10-011

54.198.67.201USAS14618 Amazon.com, Inc.2026-10-071

44.217.155.218USAS14618 Amazon.com, Inc.2026-10-101

98.82.63.147USAS14618 Amazon.com, Inc.2026-10-071

52.44.229.124USAS14618 Amazon.com, Inc.2026-10-131

34.197.23.26USAS14618 Amazon.com, Inc.2026-10-081

98.88.179.50USAS14618 Amazon.com, Inc.2026-10-071

44.218.6.93USAS14618 Amazon.com, Inc.2026-10-071

98.83.8.142USAS14618 Amazon.com, Inc.2026-10-071

52.205.52.0USAS14618 Amazon.com, Inc.2026-10-091

98.88.165.13USAS14618 Amazon.com, Inc.2026-10-061

44.207.44.93USAS14618 Amazon.com, Inc.2026-10-061

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.