JA4 TLS client fingerprint
t13i190800_9dc949149365_97f8aa674fd9
Seen 2026-02-19 to 2026-10-17 across the retained window.
The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked.
Or watch the top network: AS8075 sends an email when it next hits a sensor.
Countries
US 2.9KCA 72NL 33DE 25FR 8CN 5BR 5GE 4GB 4RO 3
User agents claimed
Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)478 IPs186.0K
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 ModatScanner/1.2 (+https://modat.io/)72 IPs14.6K
Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity636 IPs8.9K
Mozilla/5.0 zgrab/0.x1.3K IPs2.7K
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.369 IPs1.8K
Source IPCCNetwork
Last seenEvents
85.217.149.8CAAS209334 Modat B.V.2026-10-177.4K 167.94.146.49USAS398705 Censys, Inc.2026-10-177.2K 167.94.146.57USAS398705 Censys, Inc.2026-10-177.1K 167.94.146.61USAS398705 Censys, Inc.2026-10-177.0K 167.94.146.53USAS398705 Censys, Inc.2026-10-176.9K 167.94.146.62USAS398705 Censys, Inc.2026-10-176.9K 167.94.146.50USAS398705 Censys, Inc.2026-10-176.8K 167.94.146.59USAS398705 Censys, Inc.2026-10-176.8K 167.94.146.55USAS398705 Censys, Inc.2026-10-176.8K 167.94.146.58USAS398705 Censys, Inc.2026-10-176.8K 167.94.146.60USAS398705 Censys, Inc.2026-10-176.8K 167.94.146.48USAS398705 Censys, Inc.2026-10-176.8K 167.94.146.51USAS398705 Censys, Inc.2026-10-176.7K 167.94.146.56USAS398705 Censys, Inc.2026-10-176.7K 167.94.146.54USAS398705 Censys, Inc.2026-10-176.7K 167.94.146.52USAS398705 Censys, Inc.2026-10-176.7K 167.94.146.63USAS398705 Censys, Inc.2026-10-176.5K 85.217.149.29CAAS209334 Modat B.V.2026-10-175.5K 85.217.149.15CAAS209334 Modat B.V.2026-10-174.8K 31.14.32.4NLAS201401 NewVM B.V.2026-10-174.7K
Interaction
Sessions
Sessions in the last 30 days in which a sensor answered as a product and recorded what a client with this fingerprint did once inside. Logged in, ran commands, named a download and handed over files each count sessions. Reported beside the counts above and never added to them.
Services
http:443 75http:8443 38imap:993 36tls:1963 33tls:990 28http:1963 27tls:18246 26tls:2456 25http:5986 24tls:17778 21http:18246 21tls:4839 20
ATT&CK techniques
4 techniques, 3 tacticsWhat the sessions did in MITRE ATT&CK terms. The sensors map each session from its verdict, its labels and what it named, so one session can show several techniques. The count is sessions.
TechniqueTacticSessions
T1595 Active ScanningReconnaissance6.3K T1078 Valid AccountsInitial Access18 T1190 Exploit Public-Facing ApplicationInitial Access10 T1110 Brute ForceCredential Access14 Source IPs in these sessions
most sessions firstSource IPCCNetworkLast seenSessions
167.94.146.56USAS398705 Censys, Inc.2026-10-17570 167.94.146.51USAS398705 Censys, Inc.2026-10-17491 167.94.146.61USAS398705 Censys, Inc.2026-10-17478 167.94.146.50USAS398705 Censys, Inc.2026-10-17470 167.94.146.62USAS398705 Censys, Inc.2026-10-17449 167.94.146.57USAS398705 Censys, Inc.2026-10-17443 167.94.146.49USAS398705 Censys, Inc.2026-10-17441 167.94.146.59USAS398705 Censys, Inc.2026-10-17414 167.94.146.58USAS398705 Censys, Inc.2026-10-17413 167.94.146.55USAS398705 Censys, Inc.2026-10-17400
About this fingerprint
JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.