JA4 TLS client fingerprint

t13i1911h2_9dc949149365_e5728521abd4

Seen 2026-04-16 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS9465 sends an email when it next hits a sensor.

140

Source IPs

Networks

Countries

318

Ports hit

3.3K

Events

IPs / network

Top networks

AS9465 AGOTOZ PTE. LTD.53 IPs1.4K

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED53 IPs1.3K

AS4808 China Unicom Beijing Province Network30 IPs561

AS58466 CHINANET Guangdong province network2 IPs4

AS142002 Scloud Pte Ltd2 IPs4

Countries

HK 103CN 32US 4SG 1

Ports targeted

4443/tcp 54 9443/tcp 51 443/tcp 43 5601/tcp 36 50805/tcp 33 9530/tcp 33 4433/tcp 33 50777/tcp 30 47001/tcp 30 10002/tcp 30 139/tcp 30 3306/tcp 28

What it requests

GET/2.2K

GET/favicon.ico1.1K

User agents claimed

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36139 IPs2.2K

Source IPCCNetwork Last seenEvents

106.75.24.61AS0 China Unicom Beijing Province Network2026-09-2253

156.225.1.45AS0 AGOTOZ PTE. LTD.2026-09-2151

156.225.1.37AS0 AGOTOZ PTE. LTD.2026-09-2349

152.32.190.84AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2448

152.32.254.132AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2446

118.26.38.132AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2446

156.225.1.113AS0 AGOTOZ PTE. LTD.2026-09-2445

156.225.1.43AS0 AGOTOZ PTE. LTD.2026-09-2445

156.225.1.39AS0 AGOTOZ PTE. LTD.2026-09-2444

156.225.1.34AS0 AGOTOZ PTE. LTD.2026-09-2443

156.225.1.46AS0 AGOTOZ PTE. LTD.2026-09-2439

156.225.1.36AS0 AGOTOZ PTE. LTD.2026-09-2339

156.225.1.97AS0 AGOTOZ PTE. LTD.2026-09-2439

152.32.213.95AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2239

156.225.1.18AS0 AGOTOZ PTE. LTD.2026-09-2439

152.32.188.12AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2439

156.225.1.16AS0 AGOTOZ PTE. LTD.2026-09-2439

101.36.122.18AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2437

123.58.209.194AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2337

128.1.132.84AS0 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2337

About this fingerprint

JA4 is a fingerprint of the TLS Client Hello: the version, cipher suites, extensions and signature algorithms a client offers when it opens an HTTPS connection. Clients built on the same library and version produce the same JA4, which makes it a durable handle on the tool behind the traffic.