JA4 TLS client fingerprint

t13i1515h2_8daaf6152771_d8a2da3f94cd

Seen 2026-02-22 to 2026-09-20 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS14061 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

Top networks

AS14061 DigitalOcean, LLC9 IPs17

AS34665 Petersburg Internet Network ltd.5 IPs28

AS214664 JSC Buduschee4 IPs18

AS63949 Akamai Connected Cloud2 IPs2

AS212238 Datacamp Limited1 IPs8

AS44050 Petersburg Internet Network ltd.1 IPs2

AS3320 Deutsche Telekom AG1 IPs1

AS3209 Vodafone GmbH1 IPs1

AS6805 Telefonica Germany1 IPs1

AS25369 Hydra Communications Ltd1 IPs1

AS4837 CHINA UNICOM China169 Backbone1 IPs1

Countries

US 11RU 10DE 4GB 1CN 1

Ports targeted

443/tcp 17 8443/tcp 6 45327/tcp 4 9002/tcp 4 84/tcp 2 25055/tcp 2 3365/tcp 2 3388/tcp 2 2223/tcp 2 5001/tcp 2 5601/tcp 2 5672/tcp 2

What it requests

GET/41

GET/favicon.ico30

User agents claimed

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.3610 IPs48

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.367 IPs9

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.367 IPs7

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.364 IPs6

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.361 IPs1

Source IPCCNetwork Last seenEvents

45.91.64.7AS0 JSC Buduschee2026-09-1610

147.90.209.7AS0 Datacamp Limited2026-09-058

46.161.50.108AS0 Petersburg Internet Network ltd.2026-08-296

31.184.195.246AS0 Petersburg Internet Network ltd.2026-09-196

31.184.195.244AS0 Petersburg Internet Network ltd.2026-09-206

31.184.195.248AS0 Petersburg Internet Network ltd.2026-09-186

5.101.64.6AS0 Petersburg Internet Network ltd.2026-09-014

45.91.64.6AS0 JSC Buduschee2026-08-314

162.243.64.60AS0 DigitalOcean, LLC2026-08-264

162.243.67.64AS0 DigitalOcean, LLC2026-08-264

45.91.64.8AS0 JSC Buduschee2026-09-012

138.68.19.251AS0 DigitalOcean, LLC2026-08-262

95.215.0.144AS0 Petersburg Internet Network ltd.2026-09-012

45.91.64.9AS0 JSC Buduschee2026-09-172

206.189.72.181AS0 DigitalOcean, LLC2026-08-262

157.230.174.230AS0 DigitalOcean, LLC2026-09-041

134.122.119.167AS0 DigitalOcean, LLC2026-09-091

157.230.128.50AS0 DigitalOcean, LLC2026-09-111

78.48.33.18AS0 Telefonica Germany2026-09-101

92.209.17.177AS0 Vodafone GmbH2026-09-101

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.