JA4 TLS client fingerprint

t13i1909h2_9dc949149365_97f8aa674fd9

Seen 2026-02-19 to 2026-09-11 across the retained window.

Open in lookup →

626

Source IPs

28

Networks

14

Countries

26.5K

Ports hit

81.3K

Events

22

IPs / network

Top networks

AS398324 Censys, Inc.270 IPs30.7K

AS398722 Censys, Inc.137 IPs4.9K

AS16509 Amazon.com, Inc.82 IPs22.8K

AS14061 DigitalOcean, LLC55 IPs717

AS8075 Microsoft Corporation34 IPs101

AS398705 Censys, Inc.16 IPs21.6K

AS210558 1337 Services GmbH5 IPs78

AS20473 The Constant Company, LLC4 IPs136

AS51396 Pfcloud UG (haftungsbeschrankt)3 IPs8

AS680 Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.2 IPs74

AS50304 Blix Solutions AS1 IPs113

AS197170 TechTies Inc.1 IPs39

Countries

US 588DE 13NL 13IN 2FR 1KZ 1CN 1CA 1HU 1GB 1

Ports targeted

443/tcp 762 1962/tcp 375 4841/tcp 359 4840/tcp 346 1963/tcp 343 4839/tcp 327 80/tcp 280 8443/tcp 277 1521/tcp 232 51005/tcp 227 1194/tcp 221 554/tcp 217

What it requests

GET/23.4K

GET/robots.txt256

GET/.well-known/security.txt113

GET/favicon.ico111

GET/security.txt111

GET/owa/auth/x.js33

GET/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application27

GET/ClientWebService/Client.asmx?singleWsdl20

GET/owa/auth/logon.aspx19

GET/images/transparentpix.gif12

GET/dicom-web/studies?00080020=3000010111

User agents claimed

visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.3681 IPs22.8K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.3623 IPs598

Mozilla/5.0 zgrab/0.x73 IPs226

Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)4 IPs136

Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.01 IPs113

Source IPCCNetwork Last seenEvents

18.218.118.203USAS16509 Amazon.com, Inc.2026-09-115.0K

18.116.101.220USAS16509 Amazon.com, Inc.2026-09-114.9K

3.129.187.38USAS16509 Amazon.com, Inc.2026-09-114.9K

3.130.168.2USAS16509 Amazon.com, Inc.2026-09-114.1K

3.131.220.121USAS16509 Amazon.com, Inc.2026-09-102.9K

167.94.146.52USAS398705 Censys, Inc.2026-09-111.4K

167.94.146.55USAS398705 Censys, Inc.2026-09-111.4K

167.94.146.50USAS398705 Censys, Inc.2026-09-111.4K

167.94.146.59USAS398705 Censys, Inc.2026-09-111.4K

167.94.146.57USAS398705 Censys, Inc.2026-09-111.4K

167.94.146.60USAS398705 Censys, Inc.2026-09-111.4K

167.94.146.58USAS398705 Censys, Inc.2026-09-111.4K

167.94.146.56USAS398705 Censys, Inc.2026-09-111.3K

167.94.146.54USAS398705 Censys, Inc.2026-09-111.3K

167.94.146.49USAS398705 Censys, Inc.2026-09-111.3K

167.94.146.53USAS398705 Censys, Inc.2026-09-111.3K

167.94.146.62USAS398705 Censys, Inc.2026-09-111.3K

167.94.146.63USAS398705 Censys, Inc.2026-09-111.3K

167.94.146.51USAS398705 Censys, Inc.2026-09-111.3K

167.94.146.61USAS398705 Censys, Inc.2026-09-111.3K

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.