JA4 TLS client fingerprint

t13i1909h2_9dc949149365_97f8aa674fd9

Seen 2026-02-19 to 2026-10-26 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS398324 sends an email when it next hits a sensor.

808

Source IPs

Networks

Countries

30.5K

Ports hit

82.0K

Events

IPs / network

Top networks

AS398324 Censys, Inc.369 IPs31.1K

AS14061 DigitalOcean, LLC288 IPs8.1K

AS398722 Censys, Inc.96 IPs1.8K

AS398705 Censys, Inc.16 IPs28.4K

AS51396 Pfcloud UG (haftungsbeschrankt)8 IPs38

AS16509 Amazon.com, Inc.5 IPs12.3K

AS14956 RouterHosting LLC4 IPs12

AS20473 The Constant Company, LLC3 IPs60

AS207043 Dedik Services Limited2 IPs19

AS63835 No.293,Wanbao Avenue2 IPs17

AS402506 Zenixcloud2 IPs2

AS50304 Blix Solutions AS1 IP68

Countries

US 678NL 72DE 42GB 2CN 2AU 2NO 1IN 1FR 1HU 1

Ports targeted

443/tcp 463 4841/tcp 266 4839/tcp 263 1962/tcp 261 1963/tcp 255 4840/tcp 246 8443/tcp 211 1961/tcp 189 18789/tcp 185 1723/tcp 179 30005/tcp 177 4443/tcp 177

What it requests

PRI*23.5K

GET/14.4K

GET/robots.txt1.6K

GET/favicon.ico1.5K

GET/.well-known/security.txt1.5K

GET/security.txt1.5K

GET/favicon63

GET/.well-known/robots.txt54

GET/images/transparentpix.gif12

GET/eventmanager9

POST/update/picture.cgi4

GET/ws4

User agents claimed

visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.365 IPs12.3K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36191 IPs7.8K

Mozilla/5.0 zgrab/0.x112 IPs320

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.01 IP68

Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)3 IPs60

Source IPCCNetwork Last seenEvents

3.129.187.38USAS16509 Amazon.com, Inc.2026-10-263.8K

18.218.118.203USAS16509 Amazon.com, Inc.2026-10-263.6K

3.130.168.2USAS16509 Amazon.com, Inc.2026-10-262.6K

167.94.146.53USAS398705 Censys, Inc.2026-10-261.9K

167.94.146.49USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.61USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.57USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.56USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.59USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.54USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.50USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.51USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.48USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.58USAS398705 Censys, Inc.2026-10-261.8K

167.94.146.62USAS398705 Censys, Inc.2026-10-261.7K

167.94.146.60USAS398705 Censys, Inc.2026-10-261.7K

167.94.146.55USAS398705 Censys, Inc.2026-10-261.7K

18.116.101.220USAS16509 Amazon.com, Inc.2026-10-251.7K

167.94.146.52USAS398705 Censys, Inc.2026-10-261.7K

167.94.146.63USAS398705 Censys, Inc.2026-10-261.7K

Interaction

Sessions

Sessions in the last 30 days in which a sensor answered as a product and recorded what a client with this fingerprint did once inside. Logged in, ran commands, named a download and handed over files each count sessions. Reported beside the counts above and never added to them.

9.9K

Sessions

505

Source IPs

Logged in

Ran commands

Named a download

Handed over files

Services

tls:8096 445http:443 151http:8443 49tls:4839 32tls:4841 31tls:1961 27tls:1963 27tls:44817 26tls:18246 26tls:20546 24tls:71 24tls:2 23

ATT&CK techniques

2 techniques, 2 tactics

What the sessions did in MITRE ATT&CK terms. The sensors map each session from its verdict, its labels and what it named, so one session can show several techniques. The count is sessions.

TechniqueTacticSessions

T1595 Active ScanningReconnaissance1.8K

T1190 Exploit Public-Facing ApplicationInitial Access11

Source IPs in these sessions

most sessions first

Source IPCCNetworkLast seenSessions

18.218.118.203USAS16509 Amazon.com, Inc.2026-10-26503

157.66.56.87IDAS58477 Argon Data Communication2026-10-25445

3.129.187.38USAS16509 Amazon.com, Inc.2026-10-26425

3.130.168.2USAS16509 Amazon.com, Inc.2026-10-26396

167.94.146.50USAS398705 Censys, Inc.2026-10-26251

167.94.146.56USAS398705 Censys, Inc.2026-10-26242

167.94.146.59USAS398705 Censys, Inc.2026-10-26240

167.94.146.57USAS398705 Censys, Inc.2026-10-26238

167.94.146.49USAS398705 Censys, Inc.2026-10-26236

167.94.146.61USAS398705 Censys, Inc.2026-10-26235

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.