JA4 TLS client fingerprint

t13i131000_f57a46bbacb6_e5728521abd4

Seen 2026-02-19 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS12552 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

492

Events

IPs / network

Top networks

AS12552 GlobalConnect AB24 IPs38

AS46844 Sharktech6 IPs12

AS202412 Omegatech LTD4 IPs78

AS132203 Tencent Building, Kejizhongyi Avenue4 IPs4

AS8075 Microsoft Corporation3 IPs52

AS213388 Iic Rail Limited3 IPs26

AS204428 SS-Net2 IPs103

AS45102 Alibaba (US) Technology Co., Ltd.2 IPs38

AS201814 MEVSPACE sp. z o.o.1 IPs72

AS57497 Faraso Samaneh Pasargad Ltd.1 IPs18

AS23273 HostPapa1 IPs17

AS396982 Google LLC1 IPs6

Countries

SE 24US 15NL 6RO 5BG 2SG 2TR 1IN 1AU 1DE 1

Ports targeted

443/tcp 172 2087/tcp 126 444/tcp 26 445/tcp 22 8443/tcp 22 80/tcp 12 4433/tcp 10 10443/tcp 8 44300/tcp 8 4443/tcp 8 8080/tcp 7 943/tcp 6

What it requests

GET/openid_connect/cpanelid64

POST/login/?login_only=164

GET/61

GET/.env44

GET/.git/config28

GET/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd25

GET/my.policy21

GET/vpn/index.html20

GET/RDWeb/Pages/en-US/login.aspx20

GET/login18

GET/api/sonicos/is-sslvpn-enabled17

GET/rdweb/pages/zh-cn/login.aspx8

User agents claimed

Go-http-client/1.117 IPs313

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.03 IPs25

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.362 IPs17

Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/11511 IPs13

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.311 IPs13

Source IPCCNetwork Last seenEvents

80.94.95.29AS0 SS-Net2026-09-0994

194.180.49.37AS0 MEVSPACE sp. z o.o.2026-08-3172

47.251.42.6AS0 Alibaba (US) Technology Co., Ltd.2026-09-2336

13.72.110.24AS0 Microsoft Corporation2026-09-2428

158.94.211.20AS0 Omegatech LTD2026-09-2420

158.94.211.18AS0 Omegatech LTD2026-09-2420

158.94.211.6AS0 Omegatech LTD2026-09-2420

158.94.211.22AS0 Omegatech LTD2026-09-0818

52.146.20.92AS0 Microsoft Corporation2026-09-1618

212.18.108.190AS0 Faraso Samaneh Pasargad Ltd.2026-09-2118

192.161.49.2AS0 HostPapa2026-08-3117

45.142.193.239AS0 Iic Rail Limited2026-09-0811

80.94.95.146AS0 SS-Net2026-08-269

45.142.193.167AS0 Iic Rail Limited2026-09-039

35.200.191.248AS0 Google LLC2026-09-036

48.211.158.211AS0 Microsoft Corporation2026-08-306

94.154.43.87AS0 Storm Industries LLC2026-09-046

45.142.193.221AS0 Iic Rail Limited2026-09-156

85.11.167.250AS0 TechTies Inc.2026-08-285

93.158.90.65AS0 GlobalConnect AB2026-09-095

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.