JA4 TLS client fingerprint

t13i100900_61a7ad8aa9b6_367aa026f35a

Seen 2026-08-26 to 2026-09-20 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS215925 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

1.5K

Ports hit

1.6K

Events

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS215925 Vpsvault.host Ltd23 IPs864

AS401661 EMBNEX, LLC23 IPs97

AS209630 LLC Vash Kredit Bank19 IPs635

Countries

US 32AE 19BR 14

Ports targeted

61234/tcp 4 5985/tcp 3 9150/tcp 3 47001/tcp 3 49501/tcp 3 2048/tcp 2 2083/tcp 2 3530/tcp 2 4516/tcp 2 4646/tcp 2 4931/tcp 2 5061/tcp 2

What it requests

GET/favicon.ico1.5K

GET/48

User agents claimed

Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)65 IPs1.6K

Source IPCCNetwork Last seenEvents

45.205.1.245AS0 Vpsvault.host Ltd2026-09-0477

45.205.1.240AS0 Vpsvault.host Ltd2026-09-0476

45.205.1.243AS0 Vpsvault.host Ltd2026-09-0475

45.205.1.241AS0 Vpsvault.host Ltd2026-09-0474

45.205.1.246AS0 Vpsvault.host Ltd2026-09-0474

45.205.1.242AS0 Vpsvault.host Ltd2026-09-0874

45.205.1.247AS0 Vpsvault.host Ltd2026-09-0471

151.243.11.12AS0 LLC Vash Kredit Bank2026-08-2769

151.243.11.15AS0 LLC Vash Kredit Bank2026-08-2867

151.243.11.20AS0 LLC Vash Kredit Bank2026-08-2865

151.243.11.16AS0 LLC Vash Kredit Bank2026-08-2862

151.243.11.14AS0 LLC Vash Kredit Bank2026-08-2862

151.243.11.17AS0 LLC Vash Kredit Bank2026-08-2762

151.243.11.13AS0 LLC Vash Kredit Bank2026-08-2862

45.205.1.244AS0 Vpsvault.host Ltd2026-09-0462

151.243.11.18AS0 LLC Vash Kredit Bank2026-08-2860

151.243.11.11AS0 LLC Vash Kredit Bank2026-08-2859

151.243.11.19AS0 LLC Vash Kredit Bank2026-08-2857

45.194.67.44AS0 Vpsvault.host Ltd2026-09-0742

45.194.67.45AS0 Vpsvault.host Ltd2026-09-0840

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.