JA4 TLS client fingerprint

t13i100900_61a7ad8aa9b6_cb8fff09048f

Seen 2026-08-22 to 2026-09-21 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS401661 sends an email when it next hits a sensor.

111

Source IPs

Networks

Countries

2.7K

Ports hit

7.8K

Events

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS401661 EMBNEX, LLC52 IPs2.5K

AS209630 LLC Vash Kredit Bank33 IPs2.0K

AS215925 Vpsvault.host Ltd26 IPs3.3K

Countries

US 52BR 35AE 33

Ports targeted

6036/tcp 89 443/tcp 77 5060/tcp 76 119/tcp 73 25566/tcp 70 554/tcp 70 1433/tcp 68 445/tcp 67 80/tcp 66 8443/tcp 65 4145/tcp 64 25565/tcp 62

What it requests

GET/5.0K

GET/favicon.ico2.8K

User agents claimed

Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)111 IPs7.8K

Source IPCCNetwork Last seenEvents

16.5.0.244AS0 EMBNEX, LLC2026-09-09747

45.205.1.242AS0 Vpsvault.host Ltd2026-09-08342

16.5.0.133AS0 EMBNEX, LLC2026-09-07333

45.205.1.243AS0 Vpsvault.host Ltd2026-09-08332

45.205.1.246AS0 Vpsvault.host Ltd2026-09-08330

45.205.1.247AS0 Vpsvault.host Ltd2026-09-08329

45.205.1.241AS0 Vpsvault.host Ltd2026-09-08322

45.205.1.245AS0 Vpsvault.host Ltd2026-09-08320

16.5.0.254AS0 EMBNEX, LLC2026-09-08299

45.205.1.244AS0 Vpsvault.host Ltd2026-09-08290

45.205.1.240AS0 Vpsvault.host Ltd2026-09-08289

16.5.0.245AS0 EMBNEX, LLC2026-09-09270

151.243.11.13AS0 LLC Vash Kredit Bank2026-08-29236

151.243.11.12AS0 LLC Vash Kredit Bank2026-08-29230

151.243.11.16AS0 LLC Vash Kredit Bank2026-08-29219

151.243.11.17AS0 LLC Vash Kredit Bank2026-08-29216

151.243.11.8AS0 LLC Vash Kredit Bank2026-08-28152

16.5.0.241AS0 AS4016612026-09-21140

16.5.0.239AS0 AS4016612026-09-21126

151.243.11.9AS0 LLC Vash Kredit Bank2026-08-31109

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.