JA4 TLS client fingerprint

t13i131000_f57a46bbacb6_ab7e3b40a677

Seen 2026-02-19 to 2026-10-17 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS396982 sends an email when it next hits a sensor.

3.1K

Source IPs

Networks

Countries

35.5K

Ports hit

298.8K

Events

IPs / network

Top networks

AS396982 Google LLC1.9K IPs80.6K

AS398324 Censys, Inc.366 IPs86.7K

AS202412 Omegatech LTD221 IPs10.3K

AS219326 SULAVI LTD164 IPs731

AS398722 Censys, Inc.96 IPs8.7K

AS14061 DigitalOcean, LLC76 IPs693

AS47583 Hostinger International Limited41 IPs664

AS51167 Contabo GmbH37 IPs1.1K

AS398705 Censys, Inc.16 IPs81.4K

AS16276 OVH SAS16 IPs364

AS207043 Dedik Services Limited12 IPs1.1K

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED12 IPs19

Countries

US 2.3KGB 516FR 51DE 48NL 32SG 18CA 13CN 9BR 7BG 5

Ports targeted

443/tcp 14.6K 3000/tcp 2.9K 8443/tcp 2.2K 4841/tcp 615 1962/tcp 573 4840/tcp 564 1963/tcp 556 4839/tcp 550 1961/tcp 543 18789/tcp 440 44819/tcp 424 20546/tcp 410

What it requests

GET/favicon.ico176.8K

GET/82.8K

GET/logs?format=xml18.6K

GET/remote/login308

GET/RDWeb/Pages/en-US/login.aspx286

GET/manager/html246

GET/login245

GET/wp-login.php245

GET/api/status245

GET/admin245

GET/api/trpc245

GET/api/config245

User agents claimed

Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)478 IPs176.7K

Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity1.9K IPs80.2K

mailcore/collect2 IPs18.7K

Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)14 IPs15.5K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36123 IPs2.7K

Source IPCCNetwork Last seenEvents

220.158.232.232KHAS38623 ISP/IXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.2026-10-1618.6K

167.94.146.49USAS398705 Censys, Inc.2026-10-175.4K

167.94.146.57USAS398705 Censys, Inc.2026-10-175.3K

167.94.146.61USAS398705 Censys, Inc.2026-10-175.2K

167.94.146.53USAS398705 Censys, Inc.2026-10-175.2K

167.94.146.62USAS398705 Censys, Inc.2026-10-175.1K

167.94.146.55USAS398705 Censys, Inc.2026-10-175.1K

167.94.146.50USAS398705 Censys, Inc.2026-10-175.1K

167.94.146.60USAS398705 Censys, Inc.2026-10-175.1K

167.94.146.48USAS398705 Censys, Inc.2026-10-175.1K

167.94.146.58USAS398705 Censys, Inc.2026-10-175.1K

167.94.146.59USAS398705 Censys, Inc.2026-10-175.0K

167.94.146.52USAS398705 Censys, Inc.2026-10-175.0K

167.94.146.51USAS398705 Censys, Inc.2026-10-175.0K

167.94.146.54USAS398705 Censys, Inc.2026-10-175.0K

167.94.146.56USAS398705 Censys, Inc.2026-10-174.9K

167.94.146.63USAS398705 Censys, Inc.2026-10-174.8K

87.120.104.29NOAS211443 Sino Worldwide Trading Limited2026-10-103.1K

94.154.46.244USAS202412 Omegatech LTD2026-10-012.3K

79.124.58.82BGAS50360 Tamatiya EOOD2026-10-092.2K

Interaction

Sessions

Sessions in the last 30 days in which a sensor answered as a product and recorded what a client with this fingerprint did once inside. Logged in, ran commands, named a download and handed over files each count sessions. Reported beside the counts above and never added to them.

5.3K

Sessions

1.3K

Source IPs

Logged in

Ran commands

Named a download

Handed over files

Services

http:443 16http:8443 16http:18246 12http:11103 11http:4839 10http:1963 10http:1961 9http:101 9http:9599 9http:4841 8http:4840 8http:19302 8

ATT&CK techniques

2 techniques, 2 tactics

What the sessions did in MITRE ATT&CK terms. The sensors map each session from its verdict, its labels and what it named, so one session can show several techniques. The count is sessions.

TechniqueTacticSessions

T1595 Active ScanningReconnaissance4.8K

T1078 Valid AccountsInitial Access2

Source IPs in these sessions

most sessions first

Source IPCCNetworkLast seenSessions

220.158.234.127KHAS38623 ISP/IXP IN CAMBODIA WITH THE BEST VERVICE IN THERE.2026-10-15223

167.94.146.56USAS398705 Censys, Inc.2026-10-17136

167.94.146.49USAS398705 Censys, Inc.2026-10-17112

167.94.146.62USAS398705 Censys, Inc.2026-10-17111

167.94.146.50USAS398705 Censys, Inc.2026-10-17111

167.94.146.61USAS398705 Censys, Inc.2026-10-17110

167.94.146.51USAS398705 Censys, Inc.2026-10-17100

167.94.146.57USAS398705 Censys, Inc.2026-10-1799

167.94.146.59USAS398705 Censys, Inc.2026-10-1798

167.94.146.55USAS398705 Censys, Inc.2026-10-1790

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.