JA4 TLS client fingerprint

t13i150900_8daaf6152771_18e8a06d9b2d

Seen 2026-02-19 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS10439 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

156

Ports hit

2.1K

Events

IPs / network

Top networks

AS10439 CariNet, Inc.11 IPs914

AS50219 Valence Technology Co.9 IPs919

AS32475 Internap Holding LLC3 IPs287

AS63949 Akamai Connected Cloud1 IPs1

Countries

US 23SE 1

Ports targeted

443/tcp 34 445/tcp 21 9002/tcp 20 1025/tcp 18 4430/tcp 18 4000/tcp 18 9761/tcp 17 7002/tcp 17 4443/tcp 17 9051/tcp 17 10250/tcp 17 84/tcp 17

What it requests

GET/2.1K

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.3623 IPs1.9K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.3624 IPs174

Source IPCCNetwork Last seenEvents

216.226.76.30AS0 Valence Technology Co.2026-09-24145

216.226.77.10AS0 Valence Technology Co.2026-09-24126

71.6.134.237AS0 CariNet, Inc.2026-09-22116

71.6.134.236AS0 CariNet, Inc.2026-09-24112

203.55.131.3AS0 Internap Holding LLC2026-09-24110

71.6.134.231AS0 CariNet, Inc.2026-09-24107

216.226.77.20AS0 Valence Technology Co.2026-09-24107

203.55.131.5AS0 Internap Holding LLC2026-09-23104

216.226.77.30AS0 Valence Technology Co.2026-09-23103

194.164.107.6AS0 Valence Technology Co.2026-09-18103

71.6.134.233AS0 CariNet, Inc.2026-09-22101

216.226.76.10AS0 Valence Technology Co.2026-09-2495

71.6.134.232AS0 CariNet, Inc.2026-09-2494

194.164.107.5AS0 Valence Technology Co.2026-09-2392

216.226.76.20AS0 Valence Technology Co.2026-09-2480

203.55.131.4AS0 Internap Holding LLC2026-09-2373

71.6.134.228AS0 CariNet, Inc.2026-09-2471

71.6.134.229AS0 CariNet, Inc.2026-09-2269

194.164.107.4AS0 Valence Technology Co.2026-09-2468

71.6.134.230AS0 CariNet, Inc.2026-09-2467

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.