JA4 TLS client fingerprint

t13i191000_9dc949149365_be53661681a4

Seen 2026-02-19 to 2026-07-09 across the retained window.

Open in lookup →

Source IPs

Networks

Countries

111

Ports hit

2.0K

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS202425 IP Volume inc1 IPs1.9K

AS12816 Leibniz-Rechenzentrum1 IPs118

AS204428 SS-Net1 IPs24

Countries

RO 1NL 1DE 1

Ports targeted

7777/tcp 204 443/tcp 144 5000/tcp 37 7000/tcp 34 6379/tcp 30 1293/tcp 28 53/tcp 27 1433/tcp 26 3306/tcp 26 28888/tcp 26 80/tcp 26 9955/tcp 25

Source IPCCNetworkEvents

80.82.77.202NLAS202425 IP Volume inc1.9K

138.246.253.24DEAS12816 Leibniz-Rechenzentrum118

80.94.95.40ROAS204428 SS-Net24

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.