JA4 TLS client fingerprint

t13i1910h2_9dc949149365_e7c285222651

Seen 2026-02-19 to 2026-09-11 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS9465 sends an email when it next hits a sensor.

138

Source IPs

Networks

Countries

382

Ports hit

4.9K

Events

IPs / network

Top networks

AS9465 AGOTOZ PTE. LTD.54 IPs2.0K

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED53 IPs2.2K

AS4808 China Unicom Beijing Province Network29 IPs683

AS58466 CHINANET Guangdong province network2 IPs4

Countries

HK 106CN 31SG 1

Ports targeted

9443/tcp 81 5601/tcp 69 139/tcp 50 47001/tcp 45 135/tcp 42 111/tcp 40 50995/tcp 39 50580/tcp 36 27017/tcp 36 9527/tcp 36 2079/tcp 36 444/tcp 36

What it requests

GET/3.3K

GET/favicon.ico1.6K

User agents claimed

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36138 IPs3.2K

Source IPCCNetwork Last seenEvents

156.225.1.15AS0 AGOTOZ PTE. LTD.2026-09-1069

123.58.219.82AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-1067

152.32.133.206AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-1063

123.58.212.136AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-1060

152.32.240.77AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-0960

156.225.1.47AS0 AGOTOZ PTE. LTD.2026-09-1059

101.36.122.18AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-0858

156.225.1.44AS0 AGOTOZ PTE. LTD.2026-09-1058

118.193.33.244AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-0958

156.225.1.13AS0 AGOTOZ PTE. LTD.2026-09-1157

123.58.217.155AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-1057

156.225.1.43AS0 AGOTOZ PTE. LTD.2026-09-0856

118.193.44.104AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-0955

118.26.38.29AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-0954

152.32.172.191AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-1054

123.58.212.238AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-0953

156.225.1.18AS0 AGOTOZ PTE. LTD.2026-09-1052

156.225.1.33AS0 AGOTOZ PTE. LTD.2026-09-0752

101.36.108.202AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-1051

156.225.1.105AS0 AGOTOZ PTE. LTD.2026-09-1051

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.