JA4 TLS client fingerprint

t13i141000_cbb2034c60b8_e5728521abd4

Seen 2026-03-17 to 2026-09-19 across the retained window.

Open in lookup →

10

Source IPs

9

Networks

6

Countries

101

Ports hit

27.1K

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS213790 Limited Network LTD2 IPs21.2K

AS208137 Feo Prest SRL1 IPs5.0K

AS202412 Omegatech LTD1 IPs818

AS197170 TechTies Inc.1 IPs35

AS63949 Akamai Connected Cloud1 IPs18

AS36352 HostPapa1 IPs6

AS218785 Tc Datacenter Limited1 IPs3

AS396982 Google LLC1 IPs2

AS62240 Clouvider Limited1 IPs1

Countries

NL 3US 2DE 2BG 1BE 1JP 1

Ports targeted

3000/tcp 6.3K 443/tcp 6.1K 5005/tcp 6.0K 3001/tcp 5.5K 5000/tcp 1.3K 8080/tcp 295 5001/tcp 288 5004/tcp 192 5002/tcp 192 5003/tcp 192 80/tcp 32 1110/tcp 13

What it requests

GET/.env81

GET/.aws/config74

GET/.aws/credentials72

GET/.azure/credentials72

GET/.env.example70

GET/wp-login.php68

GET/api/status66

GET/core/misc/drupal.js66

GET/.env.production64

GET/.env.local64

GET/.docker/config.json64

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.363 IPs3.4K

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.03 IPs3.4K

Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.153 IPs3.3K

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.363 IPs3.3K

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.03 IPs3.2K

Source IPCCNetwork Last seenEvents

192.253.248.173NLAS213790 Limited Network LTD2026-09-1820.1K

213.209.159.148DEAS208137 Feo Prest SRL2026-09-125.0K

192.253.248.163NLAS213790 Limited Network LTD2026-09-121.1K

130.12.180.127NLAS202412 Omegatech LTD2026-09-17818

93.152.221.64DEAS197170 TechTies Inc.2026-08-2935

139.162.88.198JPAS63949 Akamai Connected Cloud2026-09-1818

198.12.115.18USAS36352 HostPapa2026-09-026

185.218.86.25BGAS218785 Tc Datacenter Limited2026-09-193

34.140.3.155BEAS396982 Google LLC2026-09-192

216.24.210.10USAS62240 Clouvider Limited2026-09-141

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.