JA4 TLS client fingerprint

t13i1311h2_f57a46bbacb6_ab7e3b40a677

Seen 2026-03-17 to 2026-10-15 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

141

Ports hit

160.4K

Events

IPs / network

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.9 IPs60

AS37963 Hangzhou Alibaba Advertising Co.,Ltd.7 IPs30

AS212512 Detai Prosperous Technologies Limited5 IPs13

AS208137 Feo Prest SRL2 IPs129.8K

AS213790 Limited Network LTD2 IPs6.0K

AS198953 Proton66 OOO2 IPs183

AS204428 SS-Net1 IP22.6K

AS211590 Bucklog SARL1 IP1.8K

AS49453 Global Layer B.V.1 IP21

Countries

DE 9CN 7JP 3SG 3MY 3RU 2RO 1FR 1BR 1

Ports targeted

443/tcp 30.7K 3000/tcp 13.6K 8000/tcp 9.4K 8090/tcp 7.1K 82/tcp 6.5K 444/tcp 6.3K 83/tcp 6.2K 448/tcp 6.2K 8001/tcp 5.8K 2072/tcp 5.5K 447/tcp 5.5K 88/tcp 5.3K

What it requests

GET/962

GET/.env619

GET/admin/.env618

GET/backend/.env618

GET/api/.env618

GET/laravel/.env617

GET/.env.example617

GET/.env.save615

GET/app/.env615

GET/.env.production615

GET/core/.env615

GET/.env.local613

User agents claimed

Mozilla/5.0 (Linux; U; Android 2.3.5; en-us; M865 Build/HuaweiM865) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.12 IPs626

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7_0; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.7 Safari/533.22 IPs615

Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.172 IPs588

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/533.1 (KHTML, like Gecko) Version/8.0 Safari/533.12 IPs584

Mozilla/5.0 (X11; U; SunOS sun4m; en-US; rv:1.4b) Gecko/20030517 Mozilla Firebird/0.62 IPs574

Source IPCCNetwork Last seenEvents

213.209.159.175DEAS208137 Feo Prest SRL2026-10-1592.6K

213.209.159.154DEAS208137 Feo Prest SRL2026-10-1537.2K

80.94.95.211ROAS204428 SS-Net2026-10-1422.6K

77.90.185.243DEAS213790 Limited Network LTD2026-10-153.0K

77.90.185.244DEAS213790 Limited Network LTD2026-10-152.9K

185.177.72.64FRAS211590 Bucklog SARL2026-10-061.8K

176.120.22.61RUAS198953 Proton66 OOO2026-10-15177

5.188.86.234BRAS49453 Global Layer B.V.2026-10-0621

47.74.51.79JPAS45102 Alibaba (US) Technology Co., Ltd.2026-10-1512

8.219.222.66SGAS45102 Alibaba (US) Technology Co., Ltd.2026-10-089

8.221.139.48JPAS45102 Alibaba (US) Technology Co., Ltd.2026-10-128

47.103.36.53CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-10-108

8.221.136.6JPAS45102 Alibaba (US) Technology Co., Ltd.2026-10-137

47.254.192.213MYAS45102 Alibaba (US) Technology Co., Ltd.2026-10-137

176.120.22.240RUAS198953 Proton66 OOO2026-10-156

8.222.128.242SGAS45102 Alibaba (US) Technology Co., Ltd.2026-10-055

106.15.238.36CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-10-035

101.200.243.197CNAS37963 Hangzhou Alibaba Advertising Co.,Ltd.2026-10-015

45.82.78.100DEAS212512 Detai Prosperous Technologies Limited2026-10-154

47.250.81.7MYAS45102 Alibaba (US) Technology Co., Ltd.2026-10-104

Interaction

Sessions

Sessions in the last 30 days in which a sensor answered as a product and recorded what a client with this fingerprint did once inside. Logged in, ran commands, named a download and handed over files each count sessions. Reported beside the counts above and never added to them.

1.1K

Sessions

Source IPs

Logged in

Ran commands

Named a download

Handed over files

Services

http:5173 566http:2375 406tls:2375 66tls:5173 36

ATT&CK techniques

2 techniques, 2 tactics

What the sessions did in MITRE ATT&CK terms. The sensors map each session from its verdict, its labels and what it named, so one session can show several techniques. The count is sessions.

TechniqueTacticSessions

T1595 Active ScanningReconnaissance970

T1190 Exploit Public-Facing ApplicationInitial Access4

Source IPs in these sessions

most sessions first

Source IPCCNetworkLast seenSessions

77.90.185.243DEAS213790 Limited Network LTD2026-10-14592

77.90.185.244DEAS213790 Limited Network LTD2026-10-14482

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.