JA4 TLS client fingerprint

t13i191000_9dc949149365_be53661681a4

Seen 2026-02-19 to 2026-09-02 across the retained window.

Open in lookup →

Source IPs

Networks

Countries

256

Ports hit

1.4K

Events

IPs / network

This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.

Top networks

AS202425 IP Volume inc1 IPs1.4K

AS12816 Leibniz-Rechenzentrum1 IPs45

Countries

NL 1DE 1

Ports targeted

443/tcp 48 1293/tcp 19 58846/tcp 16 53/tcp 15 5000/tcp 13 135/tcp 13 9440/tcp 13 58888/tcp 13 16464/tcp 12 636/tcp 12 5200/tcp 12 7000/tcp 12

What it requests

GET/1.4K

GET/robots.txt45

User agents claimed

fasthttp1 IPs1.4K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.361 IPs45

Source IPCCNetwork Last seenEvents

80.82.77.202NLAS202425 IP Volume inc2026-09-021.4K

138.246.253.24DEAS12816 Leibniz-Rechenzentrum2026-09-0245

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.