JA4 TLS client fingerprint

t13i1514h2_8daaf6152771_de4a06bb82e3

Seen 2026-03-15 to 2026-07-27 across the retained window.

Open in lookup →

63

Source IPs

32

Networks

12

Countries

33

Ports hit

565

Events

2

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS200373 3xK Tech GmbH8 IPs177

AS5089 Virgin Media5 IPs5

AS2856 British Telecommunications Limited4 IPs4

AS7922 Comcast Cable Communications, LLC4 IPs4

AS216472 High Speed For Internet Services L.L.C4 IPs4

AS211590 Bucklog SARL3 IPs27

AS21928 T-Mobile USA, Inc.3 IPs3

AS3209 Vodafone GmbH3 IPs3

AS3320 Deutsche Telekom AG3 IPs3

AS15943 wilhelm.tel GmbH2 IPs2

AS5607 Sky UK Limited2 IPs2

AS701 Verizon Business2 IPs2

Countries

US 21DE 14GB 12FR 4PL 4NL 2MD 1BR 1AS 1IT 1

Ports targeted

4001/tcp 153 7443/tcp 148 19200/tcp 63 9030/tcp 27 65505/tcp 27 8501/tcp 26 443/tcp 16 10911/tcp 13 1220/tcp 12 8087/tcp 11 16601/tcp 9 8436/tcp 8

Source IPCCNetworkEvents

185.181.229.69MDAS60602 Inovare-Prim SRL301

104.167.25.34USAS200373 3xK Tech GmbH77

209.50.170.4USAS200373 3xK Tech GmbH43

65.111.13.80USAS200373 3xK Tech GmbH25

216.26.239.16BRAS200373 3xK Tech GmbH15

185.177.72.150FRAS211590 Bucklog SARL11

185.177.72.138FRAS211590 Bucklog SARL11

185.202.158.93DEAS42366 TerraTransit AG10

65.111.31.219FRAS200373 3xK Tech GmbH7

45.3.33.211USAS200373 3xK Tech GmbH5

185.177.72.137FRAS211590 Bucklog SARL5

209.50.186.65ITAS200373 3xK Tech GmbH3

216.26.251.46CAAS200373 3xK Tech GmbH2

67.175.119.144USAS7922 Comcast Cable Communications, LLC1

191.44.71.132PLAS216472 High Speed For Internet Services L.L.C1

172.56.232.254USAS21928 T-Mobile USA, Inc.1

153.100.177.14DEAS12886 LEW TelNet GmbH1

46.128.150.104DEAS35244 Tele Columbus AG1

73.87.38.146USAS7922 Comcast Cable Communications, LLC1

80.2.201.76GBAS5089 Virgin Media1

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.