JA4 TLS client fingerprint

t13i1711h1_ab0a1bf427ad_8e6e362c5eac

Seen 2026-05-13 to 2026-07-18 across the retained window.

Open in lookup →

5

Source IPs

5

Networks

3

Countries

7

Ports hit

59

Events

1

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS9009 M247 Europe SRL1 IPs31

AS7497 Computer Network Information Center of Chinese Academy of Sciences CNIC-CAS1 IPs12

AS212238 Datacamp Limited1 IPs6

AS397423 Tier.Net Technologies LLC1 IPs6

AS14061 DigitalOcean, LLC1 IPs4

Countries

US 3HK 1CN 1

Ports targeted

443/tcp 37 5001/tcp 6 5667/tcp 5 8000/tcp 4 8001/tcp 3 3001/tcp 2 3010/tcp 2

Source IPCCNetworkEvents

146.70.113.122HKAS9009 M247 Europe SRL31

124.16.115.105CNAS7497 Computer Network Information Center of Chinese Academy of Sciences CNIC-CAS12

185.98.170.5USAS212238 Datacamp Limited6

45.59.163.55USAS397423 Tier.Net Technologies LLC6

142.93.249.5USAS14061 DigitalOcean, LLC4

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.