JA4 TLS client fingerprint

t13i131200_f57a46bbacb6_fb48f8b98a29

Seen 2026-04-01 to 2026-10-04 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

224

Events

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS14061 DigitalOcean, LLC67 IPs199

AS51396 Pfcloud UG (haftungsbeschrankt)1 IPs19

AS50340 JSC Selectel1 IPs6

Countries

DE 20US 17CA 8NL 7GB 7SG 6IN 3RU 1

Ports targeted

443/tcp 16 80/tcp 9 4096/tcp 5 8400/tcp 4 12443/tcp 4 82/tcp 4 6556/tcp 4 7401/tcp 4 8006/tcp 4 9092/tcp 4 4532/tcp 4 5017/tcp 4

What it requests

GET/console/198

GET/global/health19

POST/api/host.describe6

GET/server1

User agents claimed

Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)39 IPs54

Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)33 IPs51

Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)38 IPs51

Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)34 IPs43

LatinasOC/1.01 IPs11

Source IPCCNetwork Last seenEvents

176.65.148.2NLAS51396 Pfcloud UG (haftungsbeschrankt)2026-09-2019

142.93.129.190NLAS14061 DigitalOcean, LLC2026-10-048

165.227.84.14USAS14061 DigitalOcean, LLC2026-10-046

77.223.121.74RUAS50340 JSC Selectel2026-09-136

64.227.32.66GBAS14061 DigitalOcean, LLC2026-10-046

159.89.12.166DEAS14061 DigitalOcean, LLC2026-10-045

157.245.36.108GBAS14061 DigitalOcean, LLC2026-10-045

167.99.210.137NLAS14061 DigitalOcean, LLC2026-10-035

209.38.208.202DEAS14061 DigitalOcean, LLC2026-10-045

138.68.144.227GBAS14061 DigitalOcean, LLC2026-10-045

157.230.19.140DEAS14061 DigitalOcean, LLC2026-10-045

159.65.18.197GBAS14061 DigitalOcean, LLC2026-10-035

165.22.235.3CAAS14061 DigitalOcean, LLC2026-10-035

64.225.75.246NLAS14061 DigitalOcean, LLC2026-10-044

146.190.103.103SGAS14061 DigitalOcean, LLC2026-10-044

134.122.28.88USAS14061 DigitalOcean, LLC2026-10-044

207.154.212.47DEAS14061 DigitalOcean, LLC2026-10-044

143.110.213.72CAAS14061 DigitalOcean, LLC2026-10-034

206.81.12.187USAS14061 DigitalOcean, LLC2026-10-024

157.245.113.227USAS14061 DigitalOcean, LLC2026-10-024

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.