JA4 TLS client fingerprint

t13i190800_9dc949149365_97f8aa674fd9

Seen 2026-02-19 to 2026-07-19 across the retained window.

Open in lookup →

24.6K

Source IPs

127

Networks

44

Countries

65.3K

Ports hit

2.7M

Events

194

IPs / network

Top networks

AS4837 CHINA UNICOM China169 Backbone7.8K IPs10.3K

AS396982 Google LLC6.5K IPs809.4K

AS4134 Chinanet6.3K IPs10.0K

AS14618 Amazon.com, Inc.1.1K IPs5.2K

AS398324 Censys, Inc.545 IPs370.3K

AS17622 China Unicom Guangzhou network418 IPs476

AS140061 Qinghai Telecom296 IPs466

AS17638 ASN for TIANJIN Provincial Net of CT282 IPs449

AS140726 UNICOM AnHui province network267 IPs321

AS0 191 IPs192.1K

AS17621 China Unicom Shanghai network162 IPs374

AS45102 Alibaba US Technology Co., Ltd.155 IPs1.1K

Countries

CN 15.7KUS 4.4KDE 451CA 385NL 367BE 331GB 321JP 290IN 286SG 237

Ports targeted

443/tcp 14.0K 9090/tcp 10.6K 82/tcp 9.6K 8020/tcp 8.8K 5000/tcp 8.7K 8448/tcp 8.4K 6443/tcp 7.8K 4200/tcp 7.6K 8888/tcp 7.5K 9201/tcp 7.4K 9200/tcp 7.2K 9007/tcp 6.9K

Source IPCCNetworkEvents

167.94.146.63USAS398705 Censys, Inc.26.4K

167.94.146.50USAS398705 Censys, Inc.26.4K

167.94.146.59USAS398705 Censys, Inc.26.3K

167.94.146.56USAS398705 Censys, Inc.26.3K

167.94.146.55USAS398705 Censys, Inc.26.2K

167.94.146.53USAS398705 Censys, Inc.26.2K

167.94.146.57USAS398705 Censys, Inc.26.2K

167.94.146.58USAS398705 Censys, Inc.26.1K

167.94.146.51USAS398705 Censys, Inc.25.9K

167.94.146.48USAS398705 Censys, Inc.25.8K

167.94.146.49USAS398705 Censys, Inc.25.8K

167.94.146.62USAS398705 Censys, Inc.25.8K

167.94.146.61USAS398705 Censys, Inc.25.7K

167.94.146.52USAS398705 Censys, Inc.25.7K

167.94.146.54USAS398705 Censys, Inc.25.5K

167.94.146.60USAS398705 Censys, Inc.25.3K

85.217.149.7CAAS209334 Modat B.V.10.2K

85.217.149.12CAAS209334 Modat B.V.10.2K

85.217.149.9CAAS209334 Modat B.V.9.4K

85.217.149.6CAAS209334 Modat B.V.9.1K

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.