JA4 TLS client fingerprint

t13i1811h1_85036bcba153_d41ae481755e

Seen 2026-02-19 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS21859 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

992

Events

IPs / network

Top networks

AS21859 Zenlayer Inc14 IPs36

AS211680 Sistemas Informaticos, S.A.11 IPs38

AS12876 Scaleway SAS8 IPs8

AS396982 Google LLC5 IPs63

AS137266 CHINATELECOM Hubei province Wuhan 5G network3 IPs14

AS212238 Datacamp Limited3 IPs13

AS11878 tzulo, inc.3 IPs9

AS132203 Tencent Building, Kejizhongyi Avenue2 IPs40

AS8075 Microsoft Corporation2 IPs14

AS135392 MillenialHost Limited2 IPs7

AS9498 BHARTI Airtel Ltd.1 IPs540

AS48090 Techoff Srv Limited1 IPs96

Countries

PT 25US 16PL 5CN 4FR 4IN 3GB 3SG 2BG 1NL 1

Ports targeted

443/tcp 667 2087/tcp 33 8443/tcp 33 9527/tcp 27 80/tcp 27 5985/tcp 27 9443/tcp 26 5577/tcp 22 3000/tcp 20 5000/tcp 19 8000/tcp 19 2083/tcp 11

What it requests

GET/116

GET/sse37

POST/mcp37

GET/openid_connect/cpanelid13

POST/login/?login_only=113

POST/dns-query8

GET/v1/models7

GET/.env7

GET/.git/HEAD6

GET/.git/refs/remotes/origin/HEAD5

GET/.git/refs/remotes/origin/main5

GET/.git/refs/remotes/origin/master5

User agents claimed

Python/3.10 aiohttp/3.13.11 IPs96

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.361 IPs91

python-httpx/0.28.133 IPs82

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:110.0) Gecko/20100101 Firefox/110.01 IPs63

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/113.0.1774.571 IPs57

Source IPCCNetwork Last seenEvents

152.52.78.232AS0 BHARTI Airtel Ltd.2026-09-02540

93.123.109.107AS0 Techoff Srv Limited2026-08-2896

91.92.241.151AS0 Omegatech LTD2026-09-1981

43.130.246.117AS0 Tencent Building, Kejizhongyi Avenue2026-09-1524

34.29.248.81AS0 Google LLC2026-09-0722

35.197.50.111AS0 Google LLC2026-08-2920

43.173.75.80AS0 Tencent Building, Kejizhongyi Avenue2026-09-1516

221.232.249.221AS0 CHINATELECOM Hubei province Wuhan 5G network2026-09-1110

172.166.156.97AS0 Microsoft Corporation2026-09-208

103.168.95.200AS0 A S C S C DIGITAL PRIVATE LIMITED2026-09-097

107.167.186.143AS0 Google LLC2026-09-237

34.29.50.142AS0 Google LLC2026-09-127

35.224.174.47AS0 Google LLC2026-09-137

85.203.46.7AS0 Datacamp Limited2026-09-136

47.253.116.19AS0 Alibaba (US) Technology Co., Ltd.2026-09-226

45.156.128.51AS0 Sistemas Informaticos, S.A.2026-09-026

135.119.239.128AS0 Microsoft Corporation2026-09-136

45.156.129.75AS0 Sistemas Informaticos, S.A.2026-09-156

185.226.197.27AS0 Zenlayer Inc2026-09-116

85.203.46.74AS0 Datacamp Limited2026-09-126

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.