JA4 TLS client fingerprint
t13i190800_9dc949149365_558910e692bf
Seen 2026-10-27 to 2026-10-28 across the retained window.
The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS209334 sends an email when it next hits a sensor.
24
Source IPs
2
Networks
3
Countries
150
Ports hit
152
Events
12
IPs / network
This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.
Top networks
Countries
What it requests
User agents claimed
Interaction
Sessions
Sessions in the last 30 days in which a sensor answered as a product and recorded what a client with this fingerprint did once inside. Logged in, ran commands, named a download and handed over files each count sessions. Reported beside the counts above and never added to them.
484
Sessions
27
Source IPs
0
Logged in
0
Ran commands
0
Named a download
0
Handed over files
Services
ATT&CK techniques
1 technique, 1 tacticWhat the sessions did in MITRE ATT&CK terms. The sensors map each session from its verdict, its labels and what it named, so one session can show several techniques. The count is sessions.
Source IPs in these sessions
most sessions firstAbout this fingerprint
JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.